Back to Database
Status published
Medium
CVE-2025-21608
Forged packets over MQTT can show up in direct messages in Meshtastic firmware
Vulnerability Description
Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node even though they were not decoded with PKC. This issue has been addressed in version 2.5.19 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-21608
Credits & Attribution
No credits recorded in the NVD database.
More from meshtastic
View All →CVE-2025-55293
Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
Critical
9.4
CVE-2025-55292
In Meshtastic, an attacker can spoof licensed amateur flag for a node
High
8.2
CVE-2025-53637
Meshtastic allows Command Injection in GitHub Action
Medium
4.1
CVE-2025-53627
Meshtastic firmware allows forged DMs with no PKC to show up as encrypted
Medium
5.3
CVE-2025-52883
Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted
Medium
5.3
Affected Vendor
meshtastic
View all reports →Affected Software
firmware
Vulnerable Versions:
>= 2.5.0, <= 2.5.18
Timeline
Official Publish:
February 18th, 2025
Last Modified:
February 19th, 2025
Added to House:
July 22nd, 2026