A critical flaw in Meshtastic firmware allows unauthenticated attackers to spoof node identities and downgrade communication security, potentially leading to unauthorized interception of mesh traffic.

The vulnerability stems from identifying nodes by their MAC-derived NodeID rather than a public key, which allows an unauthenticated attacker to force nodes into a non-encrypted HAM mode. By injecting forged NodeInfo packets, an attacker can overwrite the local NodeDB and force other nodes to communicate using shared channel keys instead of secure public key cryptography.

The exploitation of this vulnerability results in a significant loss of confidentiality for mesh network communications. Because an attacker can downgrade security to unencrypted modes, sensitive data transmitted over the mesh is exposed to unauthorized monitoring and tampering. With a CVSS score of 8.2, this vulnerability represents a high risk to the integrity and privacy of mesh-based deployments, particularly in environments relying on secure messaging.

Immediate Action: Update all Meshtastic firmware to version 2.7.6.834c3c5 or later to implement the required identity verification improvements.

Proactive Monitoring: Monitor network logs for frequent, repetitive NodeInfo broadcasts or unexpected changes to node configurations and identity details within the mesh.

Compensating Controls: In environments where updates cannot be immediately applied, isolate critical communication channels and implement secondary application-level encryption to mitigate the impact of downgraded transport security.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (nightjoker7/meshtastic-spoof-research).

The severity of this flaw necessitates immediate attention, as it undermines the core trust model of the Meshtastic protocol. Security administrators must prioritize upgrading firmware to the patched release to restore proper identity verification and encryption enforcement. Failure to remediate leaves mesh nodes vulnerable to persistent spoofing and traffic interception.