The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node     advertising a User.long_name that contains a malformed character encoding can render other radios unusable     over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted  it     can arise from ordinary buffer truncation and has been observed occurring naturally in the wild. At least     one code path could place a null terminator in the middle of a multibyte sequence, leaving a malformed     User.long_name in the node database. The problem surfaced downstream: the iOS app enforced encoding     validation and therefore cannot parse a node database once it contains a poisoned entry. This caused BLE     sync to enter a fail/retry loop, resulting in loss of control over the affected device. For a typical user     managing their radio with the iOS app, the device becomes effectively unusable until the poisoned node     ages out of the on-device database, or unless they have an alternate management path (e.g., the Python     CLI, which can be used to identify and remove the offending entries manually). Because the malformed name     propagates through the mesh, the temporary presence of a single affected node can degrade BLE management     for iOS users across a wide geographical area for an extended period. Less technical users have no     straightforward recovery path. Starting in version 2.7.23.b246bcd, the firmware has added input     sanitization and regression tests demonstrating recovery for already-poisoned devices. The apps have also     taken steps to ensure more graceful handling of malformed encoding sequences as well. (CVE-2026-42566)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-42566

high Nessus Plugin ID 328324

Version 1.2

Version 1.1

Version 1.2 Aug 24, 2026, 3:52 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSSv2 score source (set to "CVE-2026-42566") CVSSv3 score source (changed from "CVE-2026-42566" to none) Plugin Feed: 202608241552
Version 1.1 Jul 21, 2026, 12:41 AM New Plugin Feed: 202607210041