{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-12T22:02:10.946","vulnerabilities":[{"cve":{"id":"CVE-2024-47078","sourceIdentifier":"security-advisories@github.com","published":"2024-09-25T16:15:10.907","lastModified":"2024-12-02T18:31:56.817","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected phone (i.e., via bluetooth). Prior to version 2.5.1, multiple weaknesses in the MQTT implementation allow for authentication and authorization bypasses resulting in unauthorized control of MQTT-connected nodes. Version 2.5.1 contains a patch."},{"lang":"es","value":"Meshtastic es una red en malla descentralizada, fuera de la red y de código abierto. Meshtastic utiliza MQTT para comunicarse a través de una conexión a Internet con un servidor MQTT privado o compartido. Los nodos pueden comunicarse directamente a través de una conexión a Internet o mediante un proxy a través de un teléfono conectado (es decir, mediante Bluetooth). Antes de la versión 2.5.1, varias debilidades en la implementación de MQTT permitían eludir la autenticación y la autorización, lo que daba como resultado un control no autorizado de los nodos conectados a MQTT. La versión 2.5.1 contiene un parche."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-863"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2.5.1","matchCriteriaId":"E439DDC9-06DB-4E86-A0E4-4D5FF73E9870"}]}]}],"references":[{"url":"https://github.com/meshtastic/firmware/security/advisories/GHSA-vqcq-wjwx-7252","source":"security-advisories@github.com","tags":["Third Party Advisory"]}]}}]}