CVE-2024-51500
Meshtastic Firmware ≤ 2.5.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2024-51500 is a medium-severity Improper Neutralization of Special Elements (CWE-138) vulnerability in Meshtastic Meshtastic Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-45367
Vulnerability Data
Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on the…
more
network. A malicious actor could craft a packet to be from that address which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed. This issue has been addressed in release version 2.5.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.12
Mitigating Controls (NIST 800-53 r5) AI
Input validation enforces neutralization or rejection of special syntactic elements before they reach a downstream interpreter.
Security engineering principles include requirements for safe input handling and neutralization of control characters.
Output filtering can neutralize special elements before they are interpreted by a receiving component.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper neutralization of inputs to prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect instances of CWE-138 but does not itself implement the neutralization controls.
Secure development life cycle mandates input validation and sanitization that directly prevents improper neutralization of special elements.
Application security requirements explicitly call for controls against injection and malformed input that cause CWE-138.
Secure system architecture principles reduce attack surface but do not prescribe the specific neutralization techniques needed for CWE-138.
Secure coding standards require proper escaping and neutralization of special elements, directly eliminating CWE-138.