CVE-2024-51500 - CVE House
Back to Database
Status published Medium CVE-2024-51500

Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware

Vulnerability Description

Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed. This issue has been addressed in release version 2.5.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51500

Credits & Attribution

No credits recorded in the NVD database.

References

More from meshtastic

View All →
CVE-2025-55293
Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
Critical 9.4
CVE-2025-55292
In Meshtastic, an attacker can spoof licensed amateur flag for a node
High 8.2
CVE-2025-53637
Meshtastic allows Command Injection in GitHub Action
Medium 4.1
CVE-2025-53627
Meshtastic firmware allows forged DMs with no PKC to show up as encrypted
Medium 5.3
CVE-2025-52883
Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted
Medium 5.3

Affected Vendor

Affected Software

firmware
Vulnerable Versions:
< 2.5.6

Timeline

Official Publish: November 4th, 2024
Last Modified: November 5th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-138 CWE-159

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.