What is CVE-2024-47079?

CVE-2024-47079 is a medium-severity vulnerability in Meshtastic Firmware, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.4/10. Published 2024-10-07.

How severe is CVE-2024-47079?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Vulnerability in Meshtastic Firmware

CVE-2024-47079

Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the firmware does not have proper checks to ensure a remote hardware control message was received should be considered valid. This issue has been addressed in release version 2.5.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

EPSS: 0.002 (9.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H.

Affected products

Meshtastic Firmware — versions < 2.5.1
Meshtastic Meshtastic_firmware

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2024-47079?: CVE-2024-47079 is a medium-severity vulnerability in Meshtastic Firmware, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.4/10. Published 2024-10-07.
How severe is CVE-2024-47079?: Medium severity. CVSS v3 base score is 6.4 out of 10.