CVE-2024-45038 - CVE House
Back to Database
Status published High CVE-2024-45038

Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware

Vulnerability Description

Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handling, fixed in version 2.4.1 of the Meshtastic firmware and on the Meshtastic public MQTT Broker. It's strongly suggested that all users of Meshtastic, particularly those that connect to a privately hosted MQTT server, update to this or a more recent stable version right away. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45038

Credits & Attribution

No credits recorded in the NVD database.

References

More from meshtastic

View All →
CVE-2025-55293
Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
Critical 9.4
CVE-2025-55292
In Meshtastic, an attacker can spoof licensed amateur flag for a node
High 8.2
CVE-2025-53637
Meshtastic allows Command Injection in GitHub Action
Medium 4.1
CVE-2025-53627
Meshtastic firmware allows forged DMs with no PKC to show up as encrypted
Medium 5.3
CVE-2025-52883
Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted
Medium 5.3

Affected Vendor

Affected Software

firmware
Vulnerable Versions:
< 2.4.1

Timeline

Official Publish: August 27th, 2024
Last Modified: August 28th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-755

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499 Endpoint Denial of Service
Impact