Meshtastic Firmware up to 2.6.10 Direct Message entropy

Summaryinfo

A vulnerability identified as problematic has been detected in Meshtastic Firmware up to 2.6.10. This vulnerability affects unknown code of the component Direct Message Handler. Performing a manipulation results in entropy. This vulnerability is identified as CVE-2025-52464. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Meshtastic Firmware up to 2.6.10. This affects some unknown functionality of the component Direct Message Handler. The manipulation with an unknown input leads to a entropy vulnerability. CWE is classifying the issue as CWE-331. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. This is going to have an impact on confidentiality. The summary by CVE is:

Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize the internal randomness pool on some platforms, leading to possible low-entropy key generation. When users with an affected key pair sent Direct Messages, those message could be captured and decrypted by an attacker that has compiled the list of compromised keys. This issue has been patched in version 2.6.11 where key generation is delayed til the first time the LoRa region is set, along with warning users when a compromised key is detected. Version 2.6.12 furthers this patch by automatically wiping known compromised keys when found. A workaround to this vulnerability involves users doing a complete device wipe to remove vendor-cloned keys.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-52464 since 06/17/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

Upgrading to version 2.6.11 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18918). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Firmware Software

Vendor

• Meshtastic

Name

• Firmware

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 2.6.10

Website

• Product: https://github.com/meshtastic/firmware/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion