CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-45038

Medium Severity
SVRS
30/100
CVSSv3
NA/10
EPSS
0.00033/1

CVE-2024-45038: A denial of service vulnerability exists in Meshtastic device firmware's MQTT handling. This flaw affects Meshtastic devices running an open-source, off-grid mesh network. The issue is resolved in Meshtastic firmware version 2.4.1 and on the Meshtastic public MQTT Broker. Given an SVRS of 30, while not critical, this vulnerability should be addressed to prevent potential service disruptions. Users are advised to update to version 2.4.1 or a newer stable version, especially if connecting to a privately hosted MQTT server. Exploitation could lead to instability and unavailability of Meshtastic network services. No workarounds are currently available, making patching the most effective mitigation strategy.

TAGS
No tags available
VECTOR STRING
PUBLICATION DATE2024-08-27
LAST MODIFIED2024-08-28
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-45038 is a denial of service vulnerability in the MQTT handling of Meshtastic device firmware. This vulnerability allows an attacker to cause a denial of service by sending a specially crafted MQTT message to a vulnerable device.

Key Insights

  • The SVRS of 34 indicates that this vulnerability is of moderate severity and requires attention.
  • This vulnerability is actively exploited in the wild, and there are no known workarounds.
  • The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.

Mitigation Strategies

  • Update to Meshtastic firmware version 2.4.1 or later.
  • If you are unable to update your firmware, you can mitigate this vulnerability by disabling the MQTT service on your device.
  • Use a firewall to block access to the MQTT port (1883) from untrusted networks.
  • Monitor your network for suspicious activity and take appropriate action if necessary.

Additional Information

If you have any additional questions regarding this incident, you can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

No news found for this CVE

Social Media

CVE-2024-45038 (CVSS:7.5, HIGH) is Awaiting Analysis. Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh net..https://t.co/mBVYi7znxr #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
0
0
0
CVE-2024-45038 Meshtastic Firmware DoS Vulnerability in MQTT Handling - Update Now Meshtastic device firmware runs on low-power, affordable devices to create an open-source, off-grid, decentralized mesh network. ... https://t.co/9p3J8DnsBz
0
0
0

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://github.com/meshtastic/firmware/security/advisories/GHSA-3x3r-vw9f-pxq5
GITHUBhttps://github.com/meshtastic/firmware/security/advisories/GHSA-3x3r-vw9f-pxq5

CWE Details

CWE IDCWE NameDescription
CWE-755Improper Handling of Exceptional ConditionsThe software does not handle or incorrectly handles an exceptional condition.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence