Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC addr…

A vulnerability in Meshtastic open source mesh networking solution allows attackers to forge NodeInfo on behalf of victim nodes by abusing HAM mode which doesn't use encryption. Nodes are identified by NodeID generated from MAC address rather than public key, creating a security weakness. Attackers can overwrite NodeDB entries and force other nodes to communicate with victims using shared channel keys instead of public key cryptography. The attack can be made persistent by regularly resending forged NodeInfo messages. A patch is available in version 2.7.6.834c3c5.