Back to Database
Status published
Medium
CVE-2025-24798
Meshtastic crashes via an unimplemented routing module reply
Vulnerability Description
Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains want_response==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This vulnerability is fixed in 2.6.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24798
Credits & Attribution
No credits recorded in the NVD database.
References
More from meshtastic
View All →CVE-2025-55293
Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
Critical
9.4
CVE-2025-55292
In Meshtastic, an attacker can spoof licensed amateur flag for a node
High
8.2
CVE-2025-53637
Meshtastic allows Command Injection in GitHub Action
Medium
4.1
CVE-2025-53627
Meshtastic firmware allows forged DMs with no PKC to show up as encrypted
Medium
5.3
CVE-2025-52883
Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted
Medium
5.3
Affected Vendor
meshtastic
View all reports →Affected Software
firmware
Vulnerable Versions:
>= 1.2.1, < 2.6.2
Timeline
Official Publish:
July 10th, 2025
Last Modified:
July 11th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L