A critical cryptographic flaw in the Meshtastic project allows attackers to decrypt messages and hijack nodes in LoRa mesh networks. This vulnerability, caused by duplicated keys and weak randomness, affects multiple hardware platforms and emphasizes the need for timely firmware updates. #CVE-2025-52464 #Meshtastic #LoRa
Keypoints
- The vulnerability stems from duplicated encryption keys caused by mass device cloning.
- Weak randomness during key generation leads to low-entropy cryptographic keys.
- Attackers can decrypt messages, impersonate admins, and take control of network nodes.
- Firmware update 2.6.11 addresses key generation and entropy issues, with future versions providing automatic key wipes.
- Users are advised to update firmware, reset devices, and manually generate cryptographic keys for enhanced security.