CVE-2025-24797
CRITICALmeshtastic_firmware < 2.6.2 - Unauthenticated Remote Code Execution via Invalid Protobuf Data
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-24797. PoCs published by Alainx277.
AI-analyzed exploit summary The repository contains a detailed writeup of CVE-2025-24797, describing a heap-buffer-overflow vulnerability in mesh packet handling due to improper validation of protobuf data, leading to potential remote code execution. The analysis includes an ASAN report and root cause explanation.
Description
Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-controlled buffer overflow, allowing an attacker to hijack execution flow, potentially resulting in remote code execution. This attack does not require authentication or user interaction, as long as the target device rebroadcasts packets on the default channel. This vulnerability fixed in 2.6.2.
Exploits (1)
The repository contains a detailed writeup of CVE-2025-24797, describing a heap-buffer-overflow vulnerability in mesh packet handling due to improper validation of protobuf data, leading to potential remote code execution. The analysis includes an ASAN report and root cause explanation.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H