{"id":"CVE-2024-51500","summary":"Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware","details":"Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed. This issue has been addressed in release version 2.5.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.","aliases":["GHSA-xfmq-5j3j-vgv8"],"modified":"2026-08-12T15:13:09.747989Z","published":"2024-11-04T23:00:31.876Z","database_specific":{"cwe_ids":["CWE-138","CWE-159"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51500.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51500.json"},{"type":"ADVISORY","url":"https://github.com/meshtastic/firmware/security/advisories/GHSA-xfmq-5j3j-vgv8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51500"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/meshtastic/firmware","events":[{"introduced":"0"},{"fixed":"d55c08d5cdfd2b3e98b250abd156945fd5e3e8d3"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.5.6"}],"source":"AFFECTED_FIELD"}}],"versions":["v2.5.5.e182ae7","v2.5.4.8d288d5","v2.5.3.a70d5ee","v2.5.2.771cb52","v2.5.0.9ac0e26","v2.5.0.e470619","v2.5.0.9e55e6b","v2.5.0.33eb073","v2.5.0.d6dac17","v2.5.0.ab7de7f","v2.4.3.efc27f2","v2.4.2.5b45303","v2.4.1.394e0e1","v2.4.0.46d7b82","v2.3.15.deb7c27","v2.3.14.64531fa","v2.3.13.83f5ba0","v2.3.12.24458a7","v2.3.11.2740a56","v2.3.10.d19607b","v2.3.9.f06c56a","v2.3.8.d490a33","v2.3.7.30fbcab","v2.3.6.7a3570a","v2.3.5.2f9b68e","v2.3.4.ea61808","v2.3.3.8187fa7","v2.3.2.63df972","v2.3.1.4fa7f5a","v2.3.0.5f47ca1","v2.2.24.e6a2c06","v2.2.23.5672e68","v2.2.22.404d0dd","v2.2.21.7f7c5cb","v2.2.20.af5ac32","v2.2.19.8f6a283","v2.2.18.e9bde80","v2.2.17.dbac2b1","v2.2.16.1c6acfd","v2.2.15.31c4693","v2.2.14.57542ce","v2.2.13.f570204","v2.2.12.092e6f2","v2.2.11.10265aa","v2.2.10.7cebd79","v2.2.9.47301a5","v2.2.8.61f6fb2","v2.2.7.e8970ad","v2.2.6.b53cb38","v2.2.5.8255128","v2.2.4.3bcab0e","v2.2.3.282cc0b","v2.2.2.f35c7be","v2.2.1.fb5f2e4","v2.2.0.9f6584b","v2.1.23.04bbdc6","v2.1.22.191a69d","v2.1.21.97d7a89","v2.1.20.470363d","v2.1.19.eb7025f","v2.1.18.de53280","v2.1.17.7ca2e81","v2.1.16.a2c5b92","v2.1.15.cd78723","v2.1.14.99a31c1","v2.1.13.7475c86","v2.1.12.7711b03","v2.1.11.5ec624d","v2.1.10.7ef12c7","v2.1.9.d43ddc9","v2.1.7.242f880","v2.1.6.5679a82","v2.1.5.23272da","v2.1.4.958d2cf","v2.1.3.8c68d88","v2.1.2.6d20215","v2.1.1.dc2ca9c","v2.1.0.331a1af","v2.0.23.7bb281d","v2.0.22.fbfd0f1","v2.0.21.83e6cea","v2.0.20.7100416","v2.0.19.3209aea","v2.0.18.1a7991c","v2.0.17.5d1c06b","v2.0.16.2242b68","v2.0.15.aafbde0","v2.0.14.2baaad8","v2.0.13.7e27729","v2.0.12.2400dd4","v2.0.11.8914d1a","v2.0.10.e09b12c","v2.0.9.6ea0963","v2.0.8.090e166","v2.0.7.91ff7b9","v2.0.6.97fd5cf","v2.0.3.09fe616","v2.0.2.8146e84","v2.0.1.ad05b91","v2.0.0.18ab874","v1.3.48.82bcd39","v1.3.47.05147c0","v1.3.46.d4ea956","v1.3.44.4fa8d02","v1.3.43.aae9d2f","v1.3.42.9bd9252","v1.3.41.80ddb81","v1.3.40.e87ecc2","v1.3.39.ddc3727","v1.3.38.1253abd","v1.3.37.97712a9","v1.3.36.64f852e","v1.3.36.dd720f2","v1.3.36.7e03019","v1.3.35.3251cd5","v1.3.34.401b5d9","v1.3.33.ab0095c","v1.3.32.7e6c22f","v1.3.31.0084643","v1.3.30.9fe2ddb","v1.3.29.7afc149","v1.3.28.41f9541","v1.3.27.c88ba58","v1.3.26.0010231","v1.3.25.85f46d3","v1.3.24.dff6915","v1.3.23.5462d84","v1.3.22.c725a6b","v1.3.21.cf00ac5","v1.3.20.9a5ff93","v1.3.19.3c6a2f7","v1.3.17.c9822de","v1.3.16.97899ae","v1.3.15.432d067","v1.3.13.71a43a9","v1.3.12.6306c53","v1.3.11.0411401","v1.3.10.4df0e91","v1.3.10.cc2a84a","v1.3.9.92185e7","v1.3.8.90df7c2","v1.3.7.bb22b6e","v1.3.6.f511bab","v1.3.5.e5b19fd","v1.3.4.2b20bf3","v1.3.3.2fe124e","v1.2.55.9db7c62","v1.2.54.288f2be","v1.2.53.19c1f9f","v1.2.52.b63802c","v1.2.51.f9ff06b","v1.2.50.41dcfdd","v1.2.49.5354c49","v1.2.48.371335e","v1.2.47","v1.2.44.f2c9c55","v1.2.41.32f3682","v1.2.39.06892c4","v1.2.38.cf4e508","v1.2.30.80e4bc6","v1.2.29.6c95659","v1.2.testing1","1.2.11","1.2.10","1.1.33","1.2.9","1.2.6","1.2.5","1.2.4","1.2.1","1.1.50","1.1.48","1.1.47","1.1.46","1.1.42","1.1.32","1.1.31","1.1.30","1.1.7","1.1.23","1.1.20","1.1.8","1.1.6","1.1.5","1.1.4","1.1.3","1.1.2","1.1.1","1.1.0","1.0.0","0.9.7","0.9.6","0.9.5","0.9.3","0.9.2","0.9.1","0.8.1-fixed","0.7.11","0.7.10","0.7.9","0.7.8","0.7.7","0.7.6b","0.7.6","0.7.5","0.7.4","0.6.8","0.6.7","0.6.4","0.6.3","0.6.2","0.6.1","0.6.0","0.4.3","0.4.2","0.4.1","0.2.3","0.2.0","0.1.10","0.1.9","0.1.8","0.1.7","0.1.6","0.0.3"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["335515066139325701121926028660846263124","211173288112662329227897473489984298769","215064631014725993976485785022672401463","202256065693084846643385177197373959450","139423243462952571297425517069905247012"],"threshold":0.9},"id":"CVE-2024-51500-3a4dcb59","signature_type":"Line","signature_version":"v1","source":"https://github.com/meshtastic/firmware/commit/d55c08d5cdfd2b3e98b250abd156945fd5e3e8d3","target":{"file":"src/mesh/Router.cpp"}},{"source":"https://github.com/meshtastic/firmware/commit/d55c08d5cdfd2b3e98b250abd156945fd5e3e8d3","target":{"file":"src/mqtt/MQTT.cpp"},"deprecated":false,"digest":{"line_hashes":["290204097192529867406872445925844345523","260396233246697277733278906664604395338","213267353955461142027422164977867373596","193871632974543928970003768773416244187","126535825027116503517279292577079491695","294920957521485345305051682408889946297","3095637926992778553253233846251141548","270444288277042228574320699997708764387","4819944379235720405143149622993431960","18054704938626378716174815079951762485","43393449088468857295999504884471133863","69883060903855721933288865731221562769","265399648075045084481626044446746394048","337923193666273167421882032238862578696","336002739102195426363095748129582459854","198083960669745410550013214536417541637","106647515311902309178943222540523877078","153703168862875768532613154724476438796","49483048414006828161372733524822325824","32823634085995375529700350850736061241","34289244214864007677274758201167592601","210029783855659407513684590901596574577","139524174422365496730127596299214912824","206051037531421310721394931755196720517","153737618745216663607331895024499699428","112075870225538766233670897548113073843","148841233507596033879010329647827018271","43329200360890242721052832955746654891"],"threshold":0.9},"id":"CVE-2024-51500-3ebf10d3","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2024-51500-6cf80e55","signature_type":"Line","signature_version":"v1","source":"https://github.com/meshtastic/firmware/commit/d55c08d5cdfd2b3e98b250abd156945fd5e3e8d3","target":{"file":"src/mqtt/MQTT.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["145368704781214093539776497759729761886","293616334299550559549109187004914443680","29795138871899839882428147453560401908","98252524884886630128393742003983625649"]}},{"digest":{"function_hash":"305066689489855280266889911034862381131","length":2035},"id":"CVE-2024-51500-b58a96fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/meshtastic/firmware/commit/d55c08d5cdfd2b3e98b250abd156945fd5e3e8d3","target":{"file":"src/mesh/Router.cpp","function":"Router::handleReceived"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/meshtastic/firmware/commit/d55c08d5cdfd2b3e98b250abd156945fd5e3e8d3","target":{"file":"src/mqtt/MQTT.cpp","function":"MQTT::onSend"},"deprecated":false,"digest":{"function_hash":"322742624106215294240136421657604076963","length":3321},"id":"CVE-2024-51500-d2175c41","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51500.json","vanir_signatures_modified":"2026-08-12T15:13:09Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}