Meshtastic Firmware up to 2.5.0 Traceroute_APP Response improper control of interaction frequency

Summaryinfo

A vulnerability labeled as critical has been found in Meshtastic Firmware up to 2.5.0. Affected is an unknown function of the component Traceroute_APP Response Handler. Such manipulation leads to improper control of interaction frequency. This vulnerability is uniquely identified as CVE-2024-47065. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Meshtastic Firmware up to 2.5.0. Affected by this issue is an unknown part of the component Traceroute_APP Response Handler. The manipulation with an unknown input leads to a improper control of interaction frequency vulnerability. Using CWE to declare the problem leads to CWE-799. The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and continuously respond. You could easily get 100 samples in a short amount of time (estimated 2 minutes), whereas passively doing the same could take hours or days. There are secondary effects that non-ratelimited traceroute does also allow a 2:1 reflected DoS of the network as well, but these concerns are less than the problem with positional confidentiality (other DoS routes exist). This vulnerability is fixed in 2.5.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-47065 since 09/17/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.5.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-54776). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firmware Software

Vendor

• Meshtastic

Name

• Firmware

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5.0

Website

• Product: https://github.com/meshtastic/firmware/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion