CVE-2025-52464

Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize the internal randomness pool on some platforms, leading to possible low-entropy key generation. When users with an affected key pair sent Direct Messages, those message could be captured and decrypted by an attacker that has compiled the list of compromised keys. This issue has been patched in version 2.6.11 where key generation is delayed til the first time the LoRa region is set, along with warning users when a compromised key is detected. Version 2.6.12 furthers this patch by automatically wiping known compromised keys when found. A workaround to this vulnerability involves users doing a complete device wipe to remove vendor-cloned keys.

• CWE-331

• https://github.com/meshtastic/firmware/commit/4bf2dd04aeeccc4ba20c79bcaad7a572aabdecadPatch
• https://github.com/meshtastic/firmware/commit/55b2bbf93756fc7bbbfdbc7cbf29f88e6b637f22Patch
• https://github.com/meshtastic/firmware/commit/e5f6804421ac4b76dd31980250a505dba24c2aa6Patch
• https://github.com/meshtastic/firmware/commit/e623c70bd0c2ab9db9baf04888e19d1428310bb9Patch
• https://github.com/meshtastic/firmware/security/advisories/GHSA-gq7v-jr8c-mfr7Patch, Vendor Advisory

Published

Jun 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52459A vulnerability exists in Advantech iView that allows for ar…7.1
• CVE-2025-5246A vulnerability classified as critical was found in Campcode…9.8
• CVE-2025-52460Files or directories accessible to external parties issue ex…6.9
• CVE-2025-52461An out-of-bounds read vulnerability exists in the Nex parsin…9.1
• CVE-2025-52462Cross-site scripting vulnerability exists in Active! mail 6 …6.1
• CVE-2025-52463Cross-site request forgery vulnerability exists in Active! m…3.1
• CVE-2025-52465GeoServer is an open source server that allows users to shar…7.2
• CVE-2025-52467pgai is a Python library that transforms PostgreSQL into a r…9.1
• CVE-2025-52468Chamilo is a learning management system. Prior to version 1.…6.1
• CVE-2025-52469Chamilo is a learning management system. Prior to version 1.…7.1
• CVE-2025-5247A vulnerability, which was classified as critical, has been …7.3
• CVE-2025-52470Chamilo is a learning management system. Prior to version 1.…4.8