CVE-2025-55292
NodeID Spoofing in Meshtastic Enables Persistent HAM Mode Hijacking
Publication date: 2026-01-28
Last updated on: 2026-03-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| meshtastic | meshtastic_firmware | to 2.7.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-348 | The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Meshtastic arises because nodes are identified by their NodeID generated from the MAC address rather than their public key. An attacker can exploit the HAM mode, which does not use encryption, by forging a NodeInfo message that claims HAM mode is enabled for a victim node. This causes other nodes to accept the forged information and overwrite their NodeDB, forcing them to send direct messages to the victim using the shared channel key instead of the more secure public key cryptography. The attacker can also modify node details like full name and short code. The attack can be maintained by repeatedly sending the forged NodeInfo, especially after the victim sends their own.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to intercept and manipulate communications within the mesh network. Because HAM mode lacks confidentiality and authentication, the attacker can force nodes to use less secure communication methods, potentially exposing sensitive information. Additionally, the attacker can alter node details, which may lead to misinformation or impersonation within the network. This undermines the security and trustworthiness of the mesh network communications.
What immediate steps should I take to mitigate this vulnerability?
Apply the available patch by upgrading Meshtastic to version 2.7.6.834c3c5 or later to fix the vulnerability.