Firmware

This hub aggregates every CVE we track for Firmware, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Firmware.

• CVE-2026-11405Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface9.8Jul 6, 2026
• CVE-2026-7415Open MQTT orchestration without read/write ACLs in Yarbo robot firmware9.8May 7, 2026
• CVE-2026-7414Hardcoded credentials in Yarbo robot firmware9.8May 7, 2026
• CVE-2026-7413Persistent undocumented backdoor access in Yarbo robot7.2May 7, 2026
• CVE-2025-55292In Meshtastic, an attacker can spoof licensed amateur flag for a node8.2Jan 27, 2026
• CVE-2025-53627Meshtastic firmware allows forged DMs with no PKC to show up as encrypted5.3Dec 29, 2025
• CVE-2025-55293Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB9.4Aug 18, 2025
• CVE-2024-47065Traceroute_APP responses are not rate-limited.6.5Jul 11, 2025
• CVE-2025-53637Meshtastic allows Command Injection in GitHub Action4.1Jul 10, 2025
• CVE-2025-24798Meshtastic crashes via an unimplemented routing module reply4.3Jul 10, 2025
• CVE-2025-52464Meshtastic Repeated Public and Private Keypairs8.3Jun 19, 2025
• CVE-2025-24797Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow9.4Apr 14, 2025
• CVE-2025-21608Forged packets over MQTT can show up in direct messages in Meshtastic firmware5.3Feb 18, 2025
• CVE-2024-51500Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware5.3Nov 4, 2024
• CVE-2024-47079Unauthorized usage of remote hardware module because of missing channel verification6.4Oct 7, 2024