Executive brief
MeshCentral is a remote management platform used to monitor and control devices across networks. An algorithm-downgrade vulnerability allows attackers to force the use of weaker cryptographic algorithms during TLS connections, potentially exposing encrypted communications to interception and decryption. This affects confidentiality of remote management traffic between agents and the central server.
Technical details
An algorithm-downgrade vulnerability exists in MeshCentral versions prior to 1.1.17, where the TLS cipher configuration did not properly restrict weaker algorithms. The vulnerability is rooted in the mpsserver.js module's cipher suite handling, which allowed attackers on the network to downgrade TLS connections to weaker cryptographic standards (TLS 1.0/1.1 with low-strength ciphers). No authentication is required to exploit this weakness; an attacker positioned to intercept network traffic can force algorithm downgrade during the TLS handshake. The fix (commit a5efc5e) adds seclevel=0 restrictions to prevent downgrade to insecure cipher suites. Patch is available in version 1.1.17 and later.
Affected products
- Ylianst MeshCentral before 1.1.17
Timeline
- 2024-01-29: disclosed
- 2024-01-29: patched: Fixed in version 1.1.17