CVE-2025-52883 Overview
CVE-2025-52883 affects Meshtastic-Android, the Android client for the Meshtastic mesh radio protocol. Versions prior to 2.5.21 contain an improper authentication weakness [CWE-1287] that allows an attacker to send an unencrypted direct message impersonating any node on the mesh. The Android client displays the spoofed message in the same chat thread as the impersonated node and renders it with the green padlock icon associated with Public Key Cryptography (PKC) protected communications. Victims read the attacker's message as legitimate and cryptographically authenticated when it is neither. Version 2.5.21 contains a patch that corrects the display logic.
Critical Impact
Attackers on the mesh can impersonate any node in direct messages while the Android client falsely indicates end-to-end PKC protection, undermining user trust decisions.
Affected Products
- Meshtastic-Android application versions prior to 2.5.21
- Users communicating over Meshtastic mesh radios using the Android client
- Deployments relying on the PKC padlock indicator as an authenticity signal
Discovery Timeline
- 2025-06-24 - CVE-2025-52883 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-52883
Vulnerability Analysis
The flaw resides in how the Meshtastic-Android client classifies and displays incoming direct messages. The application groups messages by sender node identifier and applies the PKC padlock indicator based on chat context rather than verifying the actual cryptographic origin of each message. An attacker sends an unencrypted direct message using the shared Meshtastic channel key while claiming the node identifier of a trusted contact. The victim's Android client places that message into the existing PKC-protected conversation thread and decorates it with the green padlock. This produces a user interface state that misrepresents the security properties of the received message. The vulnerability is scoped to the client display logic and does not affect the Meshtastic firmware itself.
Root Cause
The root cause is missing per-message validation of the transport used to deliver the message [CWE-1287]. The client trusts the sender identifier field and the surrounding chat context when rendering security indicators. It does not distinguish between messages received through PKC and messages received through the shared channel key before applying the padlock icon.
Attack Vector
An attacker with access to the mesh network crafts a direct message that specifies the node ID of a legitimate participant and transmits it over the shared channel key. No user interaction beyond normally reading the chat is required by the victim. The attack is network-based and requires no authentication to the target device. The impact is limited to message integrity and authenticity perception, with no direct effect on confidentiality or availability of the client.
No public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-h4rg-g6f3-ghh7.
Detection Methods for CVE-2025-52883
Indicators of Compromise
- Direct messages appearing in a PKC-marked chat that lack the expected cryptographic metadata when inspected in device logs.
- Unexpected messages from a known contact that reference topics or context the legitimate sender denies sending.
- Meshtastic-Android installations reporting a version string below 2.5.21 in device inventory.
Detection Strategies
- Inventory Android endpoints and enumerate installed Meshtastic-Android package versions to identify installs below 2.5.21.
- Review Meshtastic packet captures or serial logs from paired radios to correlate direct message packets with their actual channel key versus PKC delivery path.
- Cross-check user reports of suspicious messages against the sender node's own outbound message log stored on the paired device.
Monitoring Recommendations
- Track application version compliance for Meshtastic-Android across managed mobile fleets and flag downgrades below 2.5.21.
- Encourage users to report messages that appear anomalous even when the PKC padlock is shown, and log those reports for triage.
- Monitor Meshtastic release channels and the project repository for follow-up advisories.
How to Mitigate CVE-2025-52883
Immediate Actions Required
- Upgrade Meshtastic-Android to version 2.5.21 or later on all devices participating in mesh communications.
- Instruct users to treat the green padlock as advisory only until every participating client is confirmed patched.
- Verify sensitive instructions received over Meshtastic through an out-of-band channel before acting on them.
Patch Information
The fix is delivered in Meshtastic-Android version 2.5.21. The change is tracked in the upstream repository through Meshtastic-Android Pull Request #1720 and documented in the GitHub Security Advisory GHSA-h4rg-g6f3-ghh7. The advisory recommends stricter validation of whether a message was received via PKC versus the shared channel key, and suggests using an explicit indicator such as the yellow half-open padlock used in HAM mode when PKC is not in effect.
Workarounds
- Disable use of shared channel key direct messaging where operationally feasible until clients are updated.
- Establish a convention that authenticity-critical messages include an agreed passphrase confirmed over a separate medium.
- Restrict mesh membership by rotating channel keys and removing untrusted participants to reduce the attacker population.
# Verify installed Meshtastic-Android version on a connected device
adb shell dumpsys package com.geeksville.mesh | grep versionName
# Expected output for patched clients:
# versionName=2.5.21 (or later)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
