CVE-2024-51500

Name of the Vulnerable Software and Affected Versions Meshtastic firmware versions prior to 2.5.6

Description The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF), which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address, which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed.

Recommendations For Meshtastic firmware versions prior to 2.5.6, upgrade to release version 2.5.6 to address the issue. As a temporary workaround, consider restricting network traffic to minimize the risk of exploitation. Avoid using the special broadcast address (0xFFFFFFFF) in packet transmissions until the issue is resolved.