# CVE-2023-51842: Ylianst MeshCentral algorithm downgrade in TLS

Source: https://junglewise.ai/threats/cve-2023-51842-ylianst-meshcentral-algorithm-downgrade-in-tls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-51842 · Severity: low · CVSS 3.1 · Published 2024-01-29

MeshCentral is a remote management platform used to monitor and control devices across networks. An algorithm-downgrade vulnerability allows attackers to force the use of weaker cryptographic algorithms during TLS connections, potentially exposing encrypted communications to interception and decryption. This affects confidentiality of remote management traffic between agents and the central server.

Technologies: [Ylianst MeshCentral](https://junglewise.ai/threats/technologies/meshcentral). Vendors: [Ylianst](https://junglewise.ai/threats/vendors/ylianst).

## Quick answers

**Is CVE-2023-51842 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-51842 being exploited in the wild.

**How severe is CVE-2023-51842?** Low severity, with a CVSS score of 3.1, published 29 January 2024.

**Which products and versions are affected?** Ylianst MeshCentral before 1.1.17.

**Is there a fix for CVE-2023-51842?** A patch was published on 2024-01-29: Fixed in version 1.1.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-51842 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-51842?** Check whether you run Ylianst MeshCentral at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An algorithm-downgrade vulnerability exists in MeshCentral versions prior to 1.1.17, where the TLS cipher configuration did not properly restrict weaker algorithms. The vulnerability is rooted in the mpsserver.js module's cipher suite handling, which allowed attackers on the network to downgrade TLS connections to weaker cryptographic standards (TLS 1.0/1.1 with low-strength ciphers). No authentication is required to exploit this weakness; an attacker positioned to intercept network traffic can force algorithm downgrade during the TLS handshake. The fix (commit a5efc5e) adds seclevel=0 restrictions to prevent downgrade to insecure cipher suites. Patch is available in version 1.1.17 and later.

## Affected products

- Ylianst MeshCentral before 1.1.17

## Identifiers

- CVE-2023-51842
- GHSA-wpxw-5xfm-x22v

## Timeline

- 2024-01-29: disclosed
- 2024-01-29: patched: Fixed in version 1.1.17

## References

- [https://github.com/Ylianst/MeshCentral/commit/a5efc5e899b8809293b297df045cff5ec0eb448b](https://github.com/Ylianst/MeshCentral/commit/a5efc5e899b8809293b297df045cff5ec0eb448b)

## Related threats

- [MeshCentral stored XSS via unsanitized agent fields](https://junglewise.ai/threats/meshcentral-stored-xss-via-unsanitized-agent-fields-1e9bee49)
- [MeshCentral WebSocket hijacking bypass in webserver.js](https://junglewise.ai/threats/cve-2026-66420-meshcentral-websocket-hijacking-bypass-in-webserver-js)
- [Ylianst MeshCentral weak cryptographic algorithm](https://junglewise.ai/threats/cve-2023-51838-ylianst-meshcentral-weak-cryptographic-algorithm)
- [Ylianst MeshCentral missing SSL certificate validation](https://junglewise.ai/threats/cve-2023-51837-ylianst-meshcentral-missing-ssl-certificate-validation)