VULNERABILITY INTELLIGENCE

CVE-2024-47078

CVSS score8.1 HIGH
EPSS probability0.46%
CISA KEVNot currently listed
Published2024-09-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected phone (i.e., via bluetooth). Prior to version 2.5.1, multiple weaknesses in the MQTT implementation allow for authentication and authorization bypasses resulting in unauthorized control of MQTT-connected nodes. Version 2.5.1 contains a patch.

Weakness classification

  • security-advisories@github.com: CWE-287
  • nvd@nist.gov: CWE-863

Primary references