CVE-2025-55293 Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB

What is CVE-2025-55293?

CVE-2025-55293 is a critical authentication bypass vulnerability in meshtastic firmware, published on 18 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Meshtastic is an open source mesh networking solution. Prior to v2.6.3, an attacker can send NodeInfo with a empty publicKey first, then overwrite it with a new key. First sending a empty key bypasses 'if (p.public_key.size > 0) {', clearing the existing publicKey (and resetting the size to 0) for a known node. Then a new key bypasses 'if (info->user.public_key.size > 0) {', and this malicious key is stored in NodeDB. This vulnerability is fixed in 2.6.3.

Weakness: CWE-287

Which versions are affected by CVE-2025-55293?

It affects 1 product.

Products include Meshtastic Meshtastic Firmware.

How do I fix CVE-2025-55293?

No fix has been published for CVE-2025-55293 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-55293 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55293 exists.

Other vulnerabilities in meshtastic firmware

• CVE-2025-52464 Meshtastic Repeated Public and Private Keypairs Critical 9.5
• CVE-2025-24797 Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow Critical 9.4
• CVE-2025-55292 In Meshtastic, an attacker can spoof licensed amateur flag for a node High 8.2
• CVE-2024-47078 Meshtastic firmware Authentication/Authorization Bypass via MQTT High 8.1
• CVE-2026-42566 Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-95pq-gj5v-4fg2.