Meshtastic CVE-2025-52464 Proof of Concept

Overview

This project is a software-only proof of concept demonstrating CVE-2025-52464, a vulnerability affecting Meshtastic firmware versions 2.5.0 to 2.6.10.

The implementation reproduces the cryptographic behaviour of the vulnerable firmware and demonstrates how duplicated or low-entropy cryptographic keys can allow an attacker to decrypt encrypted Direct Messages (DMs). It also demonstrates the patched behaviour introduced in firmware version 2.6.11, where proper key generation and low-entropy key detection prevent the attack.

Project Structure

crypto_engine.py          Cryptographic operations (X25519, HKDF, AES-GCM)
node.py                   Simulated Meshtastic node
packet.py                 Encrypted Direct Message packet
attacker.py               Passive attacker simulation
security_checker.py       Low-entropy public key detection
compromised_keys.py       Database of compromised public keys
simulation.py             Coordinates the complete simulation
demo.py                   Runs the vulnerable and patched demonstrations

test_node.py
test_packet.py
test_vulnerable_key.py
test_attacker_decrypt.py
test_fixed_case.py

Requirements

• Python 3.11 or newer
• cryptography

Installation

Create a virtual environment (optional):

python -m venv venv

Activate it.

Windows:

venv\Scripts\activate

Install the required package:

pip install -r requirements.txt

Running the Demonstration

Execute:

python demo.py

The demonstration performs two experiments:

1. Vulnerable firmware

   • Alice uses a duplicated low-entropy private key.
   • Bob successfully decrypts the message.
   • Mallory (attacker) also decrypts the intercepted message.
   • Attack succeeds.

2. Patched firmware

   • All devices generate unique cryptographic keys.
   • Bob successfully decrypts the message.
   • Mallory cannot decrypt the intercepted message.
   • Attack fails.

Running Individual Tests

The following scripts can be executed independently:

python test_node.py
python test_packet.py
python test_vulnerable_key.py
python test_attacker_decrypt.py
python test_fixed_case.py

Academic Context and Disclaimer

This project was developed as a bonus project for the Network Security course offered by the Secure Mobile Networking Lab (SEEMOO) at Technische Universität Darmstadt during the Summer Semester 2026.

It is intended solely for educational and research purposes. The implementation provides a software-only proof of concept for CVE-2025-52464 by simulating the cryptographic workflow responsible for the vulnerability. It does not implement the complete Meshtastic firmware, the LoRa physical layer, or the full Meshtastic communication stack.

The project is intended to support the study and understanding of secure key generation and cryptographic vulnerabilities and must not be used for unauthorized or malicious activities.

Author

Masoud Mehdipour

Network Security Bonus Challenge

Secure Mobile Networking Lab

TU Darmstadt