CVE-2025-55292 In Meshtastic, an attacker can spoof licensed amateur flag for a node
Attackers can spoof HAM mode to bypass encryption and modify node details in Meshtastic mesh networks, requiring firmware updates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-55292?
CVE-2025-55292 is a high-severity vulnerability in meshtastic firmware, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than their public key. This aspect downgrades the security, specifically by abusing the HAM mode which doesn't use encryption. An attacker can, as such, forge a NodeInfo on behalf of a victim node advertising that the HAM mode is enabled. This, in turn, will allow the other nodes on the mesh to accept the new information and overwriting the NodeDB. The other nodes will then only be able to send direct messages to the victim by using the shared channel key instead of the PKC. Additionally, because HAM mode by design doesn't provide any confidentiality or authentication of information, the attacker could potentially also be able to change the Node details, like the full name, short code, etc. To keep the attack persistent, it is enough to regularly resend the forged NodeInfo, in particular right after the victim sends their own. A patch is available in version 2.7.6.834c3c5.
Weakness: CWE-348
Which versions are affected by CVE-2025-55292?
It affects 1 product.
Products include Meshtastic Meshtastic Firmware.
How do I fix CVE-2025-55292?
No fix has been published for CVE-2025-55292 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-55292 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55292 exists.
Other vulnerabilities in meshtastic firmware
- CVE-2025-52464 Meshtastic Repeated Public and Private Keypairs
- CVE-2025-55293 Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB
- CVE-2025-24797 Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow
- CVE-2024-47078 Meshtastic firmware Authentication/Authorization Bypass via MQTT
- CVE-2026-42566 Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure
Sources
Also known as GHSA-45vg-3f35-7ch2.