CVE-2025-24798

Executive Summary

CVE-2025-24798 is a denial-of-service (DoS) vulnerability affecting Meshtastic, an open-source mesh networking solution. The flaw resides in the routing module, where a specially crafted packet with the want_response flag set to true causes an unhandled exception, leading to a node crash. This can be exploited by an attacker within radio range or via MQTT if downlink is enabled, resulting in degraded service for all nodes in the affected mesh. The vulnerability is fixed in version 2.6.2.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It affects the Meshtastic firmware, which is typically flashed directly onto devices. The supply chain risk is low, as the fix is available in the official Meshtastic GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Adjacent Network (AV:A) – The attacker must be within radio range of the target node or have access to the MQTT broker.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): Low (A:L) – The crash causes a temporary denial of service, but the node may restart or be recovered.

Threat Level: Medium. The vulnerability is easy to exploit but requires proximity to the target network. The impact is limited to availability.

Deep Dive & Mechanics

The Meshtastic routing module is responsible for forwarding packets through the mesh network. When a packet is received with the want_response flag set to true, the module attempts to generate a response. In vulnerable versions (1.2.1 to 2.6.2), this process lacks proper input validation and exception handling. Specifically, the code does not check for edge cases such as:

• A packet with want_response==true but missing required fields.
• A packet that triggers a null pointer dereference or division by zero during response generation.

This leads to an unhandled exception (e.g., NullPointerException or ArithmeticException), which crashes the node. The crash is immediate and does not require any special privileges.

The vulnerability can be triggered:

1. Over the air: By any node within radio range sending a crafted packet.
2. Via MQTT: If the Meshtastic node has MQTT downlink enabled, an attacker can send the malicious packet through the MQTT broker, affecting nodes that are not directly reachable via radio.

Vulnerable vs. Patched Code

The vulnerable code in the routing module (simplified pseudocode):

def handle_packet(packet):
    if packet.want_response:
        response = generate_response(packet)  # No validation
        send_packet(response)

The patched code in version 2.6.2:

def handle_packet(packet):
    if packet.want_response:
        if not validate_packet(packet):  # Input validation
            return
        try:
            response = generate_response(packet)
            send_packet(response)
        except Exception as e:
            log_error("Failed to generate response: " + str(e))

The fix adds:

• Input validation (validate_packet) to ensure the packet is well-formed.
• Exception handling (try-except) to catch and log errors without crashing.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Meshtastic node running version < 2.6.2.
• A device capable of sending Meshtastic packets (e.g., another Meshtastic node or a software-defined radio).
• (Optional) Access to the MQTT broker if downlink is enabled.

Exploitation Steps:

1. Identify a target Meshtastic node (e.g., via network scanning or physical proximity).
2. Craft a packet with the want_response flag set to true and missing required fields (e.g., empty payload).
3. Send the packet to the target node over the air or via MQTT.
4. The target node crashes, causing a denial of service.

Example Python script using the Meshtastic Python library:

import meshtastic
import meshtastic.serial_interface

interface = meshtastic.serial_interface.SerialInterface()
packet = meshtastic.protobuf.mesh_pb2.MeshPacket()
packet.want_response = True
# Intentionally leave payload empty to trigger crash
interface.send(packet)

Blue Team

Detection:

• Monitor for sudden node disconnections or crashes in the mesh network.
• Look for packets with want_response==true that are malformed or have empty payloads.
• Use the detection rules provided below.

Mitigation:

• Update all Meshtastic nodes to version 2.6.2 or later.
• Disable MQTT downlink if not required.
• Implement network segmentation to limit exposure to untrusted nodes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Malformed packets with want_response==true and missing required fields.
  • Sudden increase in node restarts or disconnections.
• Host IOCs:
  • Crash logs in the Meshtastic firmware showing unhandled exceptions in the routing module.
  • Node logs containing errors like "NullPointerException" or "ArithmeticException" in the routing module.
• File IOCs:
  • None specific to this CVE.

Detection Engineering

YARA Rule

rule CVE_2025_24798_Meshtastic_Crash {
    meta:
        description = "Detects malformed Meshtastic packets with want_response=true that cause a crash"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24798"
    strings:
        $want_response = { 08 01 }  // protobuf field 1 (want_response) set to true
        $empty_payload = { 0A 00 }  // protobuf field 2 (payload) with length 0
    condition:
        $want_response and $empty_payload
}

Sigma Rule

title: CVE-2025-24798 Meshtastic Routing Module Crash
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects malformed Meshtastic packets with want_response=true that cause a crash
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24798
logsource:
    category: application
    product: meshtastic
detection:
    selection:
        packet.want_response: true
        packet.payload: null
    condition: selection
falsepositives:
    - Legitimate packets with want_response=true and valid payload
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-24798 Meshtastic Routing Module Crash"; content:"|08 01|"; content:"|0A 00|"; within:10; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update all Meshtastic nodes to version 2.6.2 or later.
2. If update is not possible, disable MQTT downlink to reduce attack surface.
3. Monitor network traffic for malformed packets with want_response==true.

Long-Term Measures:

• Implement input validation and exception handling in all packet processing modules.
• Conduct regular security audits of the Meshtastic firmware.
• Enable logging and alerting for node crashes.

Workarounds:

• Use firewall rules to block untrusted nodes from sending packets to critical infrastructure.
• Isolate Meshtastic networks from the internet if possible.

Valters IT
Securing the Mesh, One Node at a Time