What is the CVSS score of CVE-2024-47079?

CVE-2024-47079 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.2%.

Meshtastic Firmware CVE-2024-47079

MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2024-10-07 security-advisories@github.com

Information Disclosure Meshtastic Firmware

6.4

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.4 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

CVE Published

Oct 07, 2024 - 20:15 cve.org

MEDIUM 6.4

DescriptionCVE.org

Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the firmware does not have proper checks to ensure a remote hardware control message was received should be considered valid. This issue has been addressed in release version 2.5.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

AnalysisAI

Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-345. Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an open source firmware implementation for the broader project. The remote hardware module of the firmware does not have proper checks to ensure a remote hardware control message was received should be considered valid. This issue has been addressed in release version 2.5.1. All users are advised to upgrade. There are no known workarounds for this vulnerability. Affected products include: Meshtastic Meshtastic Firmware. Version information: version 2.5.1..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.