CVE-2024-51500
HIGH EPSS 31.9%
Published Nov 4, 20241y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
Published Nov 4, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
Description
Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed. This issue has been addressed in release version 2.5.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
31.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-138
CWE-159
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| meshtastic | meshtastic_firmware | * | <2.5.6 |
References 1
- github.com https://github.com/meshtastic/firmware/security/advisories/GHSA-xfmq-5j3j-vgv8
Remediation
- github.com https://github.com/meshtastic/firmware/security/advisories/GHSA-xfmq-5j3j-vgv8