CVE-2025-21608CWE-668

Forged packets over MQTT can show up in direct messages in Meshtastic firmware

Medium · published February 18, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node even though they were not decoded with PKC. This issue has been addressed in version 2.5.19 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00372 · 30.0th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2025-02-18T18:17Z
EPSS history
Timeline
  • 18 FEB 18:17Z
    Forged packets over MQTT can show up in direct messages in Meshtastic firmware
    cvelistv5