CVE-2025-55293

The vulnerability results from flawed validation logic of the public key size during NodeInfo packet processing. In the first step, an attacker sends a NodeInfo packet with an empty publicKey field — the key size check condition ('if (p.public_key.size > 0)') evaluates to false, causing the existing public key for that node to be cleared and its size reset to 0. Next, the attacker sends another NodeInfo packet containing a new malicious public key — since the size of the previously stored key is now 0, the second validation condition ('if (info->user.public_key.size > 0)') is also bypassed, and the malicious key is persisted in the NodeDB. As a result, the attacker can impersonate any known node in the network.

An attacker can permanently overwrite the public key of a selected node in the Meshtastic network with their own key, enabling identity takeover of that node, decryption of communication directed to it, and man-in-the-middle attacks within the entire mesh network.

Meshtastic Firmware must be updated to version 2.6.3 or later, where the vulnerability has been fixed. The patch is available in the vendor's repository (commit cf7f0f9d0895602df3453a4f5cfea843f4e09744).

Meshtastic Firmware in all versions before 2.6.3