CVE-2024-47065
BaseFortify
Publication date: 2025-07-11
Last updated on: 2025-08-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| meshtastic | meshtastic_firmware | to 2.5.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-799 | The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Meshtastic prior to version 2.5.1 involves traceroute responses from remote nodes not being rate limited. Because each received transmission includes SNR measurements, an attacker can reliably and continuously trigger responses from a remote station, collecting many samples in a short time (about 2 minutes) instead of hours or days. This also allows a reflected denial-of-service (DoS) attack on the network, but the main concern is the compromise of positional confidentiality.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to rapidly gather signal-to-noise ratio (SNR) data from your remote nodes, compromising positional confidentiality. Additionally, it enables a reflected denial-of-service (DoS) attack on the network, potentially disrupting network availability.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Meshtastic to version 2.5.1 or later, as this version includes a fix that rate limits traceroute responses from remote nodes, mitigating the vulnerability.