CVE-2024-51500CWE-138CWE-159

Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware

Medium · published November 4, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed. This issue has been addressed in release version 2.5.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weaknesses
CWE-138 · Improper Neutralization of Special Elements; CWE-159 · Improper Handling of Invalid Use of Special Elements
Published
2024-11-04T23:00Z
EPSS history
Timeline
  • 04 NOV 23:00Z
    Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
    cvelistv5