What’s Vulnerable › Products

meshtastic firmware vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your meshtastic firmware version is affected

Latest meshtastic firmware vulnerabilities

• CVE-2026-44359 — Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow (CVSS 10.0)
• CVE-2026-42566 — Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure (CVSS 7.5)
• CVE-2025-55292 — In Meshtastic, an attacker can spoof licensed amateur flag for a node (CVSS 8.2)
• CVE-2025-53627 — Meshtastic firmware allows forged DMs with no PKC to show up as encrypted (CVSS 5.3)
• CVE-2025-55293 — Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB (CVSS 9.8)
• CVE-2024-47065 — Traceroute_APP responses are not rate-limited. (CVSS 6.5)
• CVE-2025-53637 — Meshtastic allows Command Injection in GitHub Action (CVSS 8.0)
• CVE-2025-24798 — Meshtastic crashes via an unimplemented routing module reply (CVSS 6.5)
• CVE-2025-52464 — Meshtastic Repeated Public and Private Keypairs (CVSS 8.3)
• CVE-2025-24797 — Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow (CVSS 9.8)
• CVE-2025-21608 — Forged packets over MQTT can show up in direct messages in Meshtastic firmware (CVSS 5.3)
• CVE-2024-51500 — Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware (CVSS 7.5)
• CVE-2024-47079 — Unauthorized usage of remote hardware module because of missing channel verification (CVSS 6.4)
• CVE-2024-47078 — Meshtastic firmware Authentication/Authorization Bypass via MQTT (CVSS 9.8)
• CVE-2024-45038 — Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware (CVSS 7.5)