CVE-2025-52464
📋 TL;DR
This vulnerability in Meshtastic firmware allows attackers to decrypt direct messages when they have compiled a list of compromised cryptographic keys. It affects users running Meshtastic firmware versions 2.5.0 through 2.6.10 on devices with duplicated vendor keys or low-entropy key generation.
💻 Affected Systems
- Meshtastic firmware
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
All direct messages sent by affected devices could be intercepted and decrypted by attackers who have obtained the list of compromised keys, leading to complete loss of message confidentiality.
Likely Case
Attackers with access to the compromised key list can decrypt some direct messages from vulnerable devices, exposing sensitive communications.
If Mitigated
With patched firmware and key rotation, only messages sent before patching remain potentially decryptable.
🎯 Exploit Status
Exploitation requires compiling a list of compromised keys and capturing encrypted direct messages. The advisory suggests attackers may have already compiled such lists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.11 (partial), 2.6.12 (complete)
Vendor Advisory: https://github.com/meshtastic/firmware/security/advisories/GHSA-gq7v-jr8c-mfr7
Restart Required: Yes
Instructions:
1. Update Meshtastic firmware to version 2.6.12 or later. 2. Follow device-specific flashing procedures. 3. The firmware will automatically detect and wipe compromised keys in version 2.6.12.
🔧 Temporary Workarounds
Complete Device Wipe
allPerforms a factory reset to remove vendor-cloned keys and generate new cryptographic keys.
Device-specific wipe procedure (consult hardware vendor documentation)
🧯 If You Can't Patch
- Disable direct messaging functionality on affected devices
- Isolate vulnerable devices from sensitive communications networks
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device admin interface. Versions 2.5.0 through 2.6.10 are vulnerable.Check Version:
Device-specific command via serial or admin interface (typically 'version' or similar)Verify Fix Applied:
Confirm firmware version is 2.6.12 or later and check for warning messages about compromised keys (which should be automatically wiped in 2.6.12).📡 Detection & Monitoring
Log Indicators:
- Warning messages about compromised key detection
- Key generation events during initial setup
Network Indicators:
- Unusual decryption attempts on encrypted direct messages
- Traffic patterns suggesting key enumeration
SIEM Query:
Search for 'compromised key' or 'key warning' in Meshtastic device logs🔗 References
- https://github.com/meshtastic/firmware/commit/4bf2dd04aeeccc4ba20c79bcaad7a572aabdecad
- https://github.com/meshtastic/firmware/commit/55b2bbf93756fc7bbbfdbc7cbf29f88e6b637f22
- https://github.com/meshtastic/firmware/commit/e5f6804421ac4b76dd31980250a505dba24c2aa6
- https://github.com/meshtastic/firmware/commit/e623c70bd0c2ab9db9baf04888e19d1428310bb9
- https://github.com/meshtastic/firmware/security/advisories/GHSA-gq7v-jr8c-mfr7
