CVE-2024-47078
HIGHmeshtastic_firmware < 2.5.1 - Authentication and Authorization Bypass via MQTT Implementation
Title source: llmDescription
Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected phone (i.e., via bluetooth). Prior to version 2.5.1, multiple weaknesses in the MQTT implementation allow for authentication and authorization bypasses resulting in unauthorized control of MQTT-connected nodes. Version 2.5.1 contains a patch.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_confirm
https://github.com/meshtastic/firmware/security/advisories/GHSA-vqcq-wjwx-7252
Scores
CVSS v3
8.1
EPSS
0.0045
EPSS Percentile
35.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-287
CWE-863
Status
published
Products (1)
meshtastic/meshtastic_firmware
< 2.5.1
Published
Sep 25, 2024
Tracked Since
Feb 18, 2026