What is CVE-2024-45038?

CVE-2024-45038 is a high-severity vulnerability in Meshtastic Firmware, classified under Improper Handling of Exceptional Conditions. CVSS score: 7.5/10. Published 2024-08-27.

How severe is CVE-2024-45038?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Meshtastic Firmware

CVE-2024-45038

Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handling, fixed in version 2.4.1 of the Meshtastic firmware and on the Meshtastic public MQTT Broker. It's strongly suggested that all users of Meshtastic, particularly those that connect to a privately hosted MQTT server, update to this or a more recent stable version right away. There are no known workarounds for this vulnerability.

EPSS: 0.006 (46.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Meshtastic Firmware — versions < 2.4.1
Meshtastic Meshtastic_firmware

Weakness classification (CWE)

CWE-755 — Improper Handling of Exceptional Conditions

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2024-45038?: CVE-2024-45038 is a high-severity vulnerability in Meshtastic Firmware, classified under Improper Handling of Exceptional Conditions. CVSS score: 7.5/10. Published 2024-08-27.
How severe is CVE-2024-45038?: High severity. CVSS v3 base score is 7.5 out of 10.