CVE-2025-55292

CVE-2025-55292 describes a critical security flaw in Meshtastic, an open-source mesh networking solution, affecting its firmware. An attacker can exploit the system's reliance on NodeIDs derived from MAC addresses, rather than public keys, to forge NodeInfo packets. This allows them to falsely advertise HAM mode for a victim node, downgrading communication security and enabling the modification of node details like full name and short code. The vulnerability carries a CVSS score of 8.2 (HIGH), indicating a severe risk due to its network-based attack vector, low attack complexity, and no user interaction required. The potential impact includes high confidentiality compromise (C:H) and low integrity compromise (I:L), as attackers can force the use of shared channel keys over Public Key Cryptography (PKC) and alter node information. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities. A patch is available in Meshtastic version 2.7.6.834c3c5.