CVE-2025-24797
Last modified
CVE-2025-24797 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-controlled buffer overflow, allowing an attacker to hijack execution flow, potentially resulting in remote code execution. EPSS estimates a 0.75% chance of exploitation in the next 30 days.
Description
Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-controlled buffer overflow, allowing an attacker to hijack execution flow, potentially resulting in remote code execution. This attack does not require authentication or user interaction, as long as the target device rebroadcasts packets on the default channel. This vulnerability fixed in 2.6.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Meshtastic | Meshtastic Firmware | < 2.6.2 |
References
- https://github.com/meshtastic/firmware/security/advisories/GHSA-33hw-xhfh-944rThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-24797?
How severe is CVE-2025-24797?
How do I fix CVE-2025-24797?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-24791snowflake-connector-nodejs is a NodeJS driver for Snowflake.…5.5
- CVE-2025-24792Snowflake PHP PDO Driver is a driver that uses the PHP Data …4.4
- CVE-2025-24793The Snowflake Connector for Python provides an interface for…7
- CVE-2025-24794The Snowflake Connector for Python provides an interface for…7.8
- CVE-2025-24795The Snowflake Connector for Python provides an interface for…5.5
- CVE-2025-24796Collabora Online is a collaborative online office suite base…6.3
- CVE-2025-24798Meshtastic is an open source mesh networking solution. From …6.5
- CVE-2025-24799GLPI is a free asset and IT management software package. An …9.8
- CVE-2025-2480Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-…8.4
- CVE-2025-24800Hyperbridge is a hyper-scalable coprocessor for verifiable, …9.3
- CVE-2025-24801GLPI is a free asset and IT management software package. An …8.8
- CVE-2025-24802Plonky2 is a SNARK implementation based on techniques from P…8.6
Are you affected by CVE-2025-24797?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST