Secuno
ENNL
Book demo

CVE-2025-55292

Meshtastic Firmware vulnerability

8.2 HIGHPublic exploitEPSS 0.15%
  1. Published27 Jan 2026

Description

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than their public key. This aspect downgrades the security, specifically by abusing the HAM mode which doesn't use encryption. An attacker can, as such, forge a NodeInfo on behalf of a victim node advertising that the HAM mode is enabled. This, in turn, will allow the other nodes on the mesh to accept the new information and overwriting the NodeDB. The other nodes will then only be able to send direct messages to the victim by using the shared channel key instead of the PKC. Additionally, because HAM mode by design doesn't provide any confidentiality or authentication of information, the attacker could potentially also be able to change the Node details, like the full name, short code, etc. To keep the attack persistent, it is enough to regularly resend the forged NodeInfo, in particular right after the victim sends their own. A patch is available in version 2.7.6.834c3c5.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

Meshtastic Firmware< 2.7.6

Remediation

Fixed in
Meshtastic Firmware≥ 2.7.6

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-616829.9
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes…
CVE-2026-923959.1
@fastify/proxy-addr is a Fastify plugin that determines a request's client address…
CVE-2026-907119.1
proxy-addr is a Node.js module that determines a request's client address behind…
CVE-2026-162729.1
Use of less trusted source vulnerability in PayTR Payment and Electronic Money…
CVE-2026-464158.2
The Caddy Defender plugin is a middleware for Caddy that allows users to block or…
CVE-2026-95618.2
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP…

Frequently asked

Is CVE-2025-55292 being actively exploited?

CVE-2025-55292 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.15%.

How severe is CVE-2025-55292?

CVE-2025-55292 has a CVSS 3.1 base score of 8.2, rated high. EPSS estimates a 0.15% probability of exploitation.

Which products are affected by CVE-2025-55292?

Affected products include Meshtastic Firmware.

How do I fix CVE-2025-55292?

Upgrade affected software to a fixed version, for example Meshtastic Firmware 2.7.6 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-55292 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.