CVE-2024-47079— Unauthorized usage of remote hardware module because of missing channel verification
Quick assessment
Affected
meshtastic firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Meshtastic device firmware是Meshtastic开源的一种用于 Meshtastic 设备运行开源、离网、去中心化网状网络的固件。 Meshtastic 2.5.1之前版本存在数据伪造问题漏洞，该漏洞源于远程硬件模块没有检查收到的远程硬件控制消息是不是有效。
Possible ATT&CK Techniques 1 AI
T1200 · Hardware Additions
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-47079
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthorized usage of remote hardware module because of missing channel verification
Source: CVE Program / CVE List V5
Vulnerability Description
Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the firmware does not have proper checks to ensure a remote hardware control message was received should be considered valid. This issue has been addressed in release version 2.5.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Vulnerability Title
Meshtastic device firmware 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Meshtastic device firmware是Meshtastic开源的一种用于 Meshtastic 设备运行开源、离网、去中心化网状网络的固件。 Meshtastic 2.5.1之前版本存在数据伪造问题漏洞，该漏洞源于远程硬件模块没有检查收到的远程硬件控制消息是不是有效。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| meshtastic | firmware | < 2.5.1 | - |
|
II. Public POCs for CVE-2024-47079
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-47079
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: firmware
-
CVE-2026-42566
Meshtastic: Malformed UTF-8 in User.long_name broadcast over -
CVE-2026-44359
Meshtastic GitHub repo vulnerable to Arbitrary Code Executio -
CVE-2026-11405
Hidden backdoor authentication mechanism in multiple version -
CVE-2026-7415
Open MQTT orchestration without read/write ACLs in Yarbo rob -
CVE-2026-7414
Hardcoded credentials in Yarbo robot firmware
Same vendor: meshtastic
-
CVE-2026-42566
Meshtastic: Malformed UTF-8 in User.long_name broadcast over -
CVE-2026-44359
Meshtastic GitHub repo vulnerable to Arbitrary Code Executio -
CVE-2025-55292
In Meshtastic, an attacker can spoof licensed amateur flag f -
CVE-2025-53627
Meshtastic firmware allows forged DMs with no PKC to show up -
CVE-2025-55293
Meshtastic allows crafting of specific NodeInfo packets that
Same weakness: CWE-345
-
CVE-2026-55663
mediasoup: SCTP state cookie lacks cryptographic authenticat -
CVE-2026-78417
Devolutions RDM 2026.2.17.0前版本密钥验证缺陷 -
CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install -
CVE-2026-58002
WWBN AVideo Authorization Bypass via Users_affiliations add. -
CVE-2026-66787
Lighthouse: lighthouse: cross-cluster dns spoofing via unval
V. Comments for CVE-2024-47079
No comments yet