CVE-2024-47065 in Firmware
Summary
by MITRE • 07/11/2025
Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and continuously respond. You could easily get 100 samples in a short amount of time (estimated 2 minutes), whereas passively doing the same could take hours or days. There are secondary effects that non-ratelimited traceroute does also allow a 2:1 reflected DoS of the network as well, but these concerns are less than the problem with positional confidentiality (other DoS routes exist). This vulnerability is fixed in 2.5.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/23/2025
The Meshtastic mesh networking solution presents a significant security vulnerability in versions prior to 2.5.1 where traceroute responses lack proper rate limiting mechanisms. This flaw enables attackers to exploit the network's inherent SNR (Signal-to-Noise Ratio) measurement system to force continuous responses from remote nodes. The vulnerability stems from the protocol's design where each received transmission includes SNR measurements that are essential for network performance optimization and routing decisions. However, this feature becomes exploitable when combined with the lack of rate limiting in traceroute functionality, creating a persistent attack vector that can be leveraged for malicious purposes.
The technical exploitation of this vulnerability allows an attacker to rapidly gather positional information and network topology data from remote stations through controlled traceroute requests. The system's inability to throttle these responses means that an attacker can accumulate approximately 100 measurement samples within a mere two-minute window, a process that would normally require hours or days of passive observation. This accelerated data collection capability directly violates fundamental security principles related to information gathering and network reconnaissance. The vulnerability operates at the application layer and represents a classic case of resource exhaustion through protocol manipulation, which aligns with CWE-770 (Allocation of Resources Without Limits or Throttling) and can be categorized under ATT&CK technique T1046 (Network Service Scanning) and T1082 (System Information Discovery).
The operational impact of this vulnerability extends beyond simple information gathering to include serious privacy and network integrity concerns. The primary threat involves the compromise of positional confidentiality, where attackers can systematically map network topology and node locations through repeated traceroute requests. This creates a significant risk for organizations relying on mesh networks for secure communications, as the vulnerability enables adversaries to construct detailed network maps without detection. Additionally, the lack of rate limiting creates secondary effects that can lead to reflected Denial of Service conditions, where the network becomes vulnerable to amplification attacks that can overwhelm legitimate traffic patterns. These reflected DoS conditions occur at a 2:1 ratio, meaning that for every unit of traffic sent by the attacker, two units of response traffic are generated, potentially causing network congestion and service disruption. The vulnerability represents a critical weakness in the mesh network's security posture and demonstrates the importance of implementing proper rate limiting and resource management controls in distributed networking protocols.
Mitigation strategies for this vulnerability require immediate deployment of Meshtastic version 2.5.1 or later, which implements proper rate limiting for traceroute responses. Organizations should also consider implementing network-level rate limiting controls and monitoring for unusual traceroute activity patterns. The fix addresses the core issue by introducing throttling mechanisms that prevent excessive response generation while maintaining legitimate network functionality. Security teams should conduct thorough network audits to identify any potential exploitation attempts and implement monitoring solutions that can detect abnormal traceroute request patterns. This vulnerability highlights the importance of security-by-design principles in distributed systems and the necessity of implementing proper resource management controls to prevent exploitation of legitimate protocol features. The remediation process should include comprehensive testing to ensure that rate limiting does not negatively impact legitimate network operations while effectively mitigating the identified threat vectors.