CVE-2024-45038
Last modified
CVE-2024-45038 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handling, fixed in version 2.4.1 of the Meshtastic firmware and on the Meshtastic public MQTT Broker. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handling, fixed in version 2.4.1 of the Meshtastic firmware and on the Meshtastic public MQTT Broker. It's strongly suggested that all users of Meshtastic, particularly those that connect to a privately hosted MQTT server, update to this or a more recent stable version right away. There are no known workarounds for this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Meshtastic | Meshtastic Firmware | < 2.4.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-45038?
How severe is CVE-2024-45038?
How do I fix CVE-2024-45038?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-45031When editing objects in the Syncope Console, incomplete HTML…6.1
- CVE-2024-45032A vulnerability has been identified in Industrial Edge Manag…10
- CVE-2024-45033Insufficient Session Expiration vulnerability in Apache Airf…8.1
- CVE-2024-45034Apache Airflow versions before 2.10.1 have a vulnerability t…8.8
- CVE-2024-45036Tophat is a mobile applications testing harness. An Improper…4.3
- CVE-2024-45037The AWS Cloud Development Kit (CDK) is an open-source framew…6.4
- CVE-2024-45039gnark is a fast zk-SNARK library that offers a high-level AP…6.2
- CVE-2024-4504A vulnerability, which was classified as critical, has been …7.2
- CVE-2024-45040gnark is a fast zk-SNARK library that offers a high-level AP…5.9
- CVE-2024-45041External Secrets Operator is a Kubernetes operator that inte…8.8
- CVE-2024-45042Ory Kratos is an identity, user management and authenticatio…4.4
- CVE-2024-45043The OpenTelemetry Collector module AWS firehose receiver is …5.3
Are you affected by CVE-2024-45038?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST