What’s Vulnerable › Vulnerabilities
CVE-2024-47078: Meshtastic firmware Authentication/Authorization Bypass via MQTT
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-25 · updated 2026-06-17
- Weakness: CWE-287
Description
Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected phone (i.e., via bluetooth). Prior to version 2.5.1, multiple weaknesses in the MQTT implementation allow for authentication and authorization bypasses resulting in unauthorized control of MQTT-connected nodes. Version 2.5.1 contains a patch.
Affected products
- meshtastic firmware: before 2.5.1 — fixed in 2.5.1
How to fix
Upgrade to a fixed version: meshtastic firmware 2.5.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-47078 or the next vulnerability affects your stack