CVE-2024-51500 Denial of service in firmware
Attackers can spoof broadcast addresses to amplify messages, causing network-wide bandwidth exhaustion and degraded performance in Meshtastic devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-51500?
CVE-2024-51500 is a medium-severity denial of service vulnerability in meshtastic firmware, published on 4 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed. This issue has been addressed in release version 2.5.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2024-51500?
It affects 1 product.
Products include Meshtastic Meshtastic Firmware.
How do I fix CVE-2024-51500?
No fix has been published for CVE-2024-51500 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-51500 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-51500 exists.
Other vulnerabilities in meshtastic firmware
- CVE-2025-52464 Meshtastic Repeated Public and Private Keypairs
- CVE-2025-55293 Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
- CVE-2025-24797 Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow
- CVE-2025-55292 In Meshtastic, an attacker can spoof licensed amateur flag for a node
- CVE-2024-47078 Meshtastic firmware Authentication/Authorization Bypass via MQTT
Sources
Also known as GHSA-xfmq-5j3j-vgv8.