Meshtastic up to 2.7.14 Direct Message pki_encrypted improper validation of specified type of input

Summaryinfo

A vulnerability was found in Meshtastic up to 2.7.14. It has been rated as problematic. Affected is an unknown function of the component Direct Message Handler. Performing a manipulation of the argument pki_encrypted results in improper validation of specified type of input. This vulnerability is reported as CVE-2025-53627. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Meshtastic up to 2.7.14. It has been classified as problematic. This affects an unknown function of the component Direct Message Handler. The manipulation of the argument pki_encrypted with an unknown input leads to a improper validation of specified type of input vulnerability. CWE is classifying the issue as CWE-1287. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. This is going to have an impact on integrity. The summary by CVE is:

Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct messages, but when the `pki_encrypted` flag is missing, the firmware silently falls back to legacy AES-256-CTR channel encryption. This was an intentional decision to maintain backwards compatibility. However, the end-user applications, like Web app, iOS/Android app, and applications built on top of Meshtastic using the SDK, did not have a way to differentiate between end-to-end encrypted DMs and the legacy DMs. This creates a downgrade attack path where adversaries who know a shared channel key can craft and inject spoofed direct messages that are displayed as if they were PKC encrypted. Users are not given any feedback of whether a direct message was decrypted with PKI or with legacy symmetric encryption, undermining the expected security guarantees of the PKI rollout. Version 2.7.15 fixes this issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-53627 since 07/07/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.7.15 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Meshtastic

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5
• 2.7.6
• 2.7.7
• 2.7.8
• 2.7.9
• 2.7.10
• 2.7.11
• 2.7.12
• 2.7.13
• 2.7.14

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion