CVE-2023-51837 is a missing SSL certificate validation flaw in Ylianst MeshCentral 1.1.16. The record rates it Critical at 9.8 and points to the mpsserver.js file. No fixed version is named, so move to the current release and read the project's notes.
What's affected
The record names MeshCentral 1.1.16. It does not list a fixed version, and the sources we reached do not state one, so check the project's release notes for the first release that addresses it.
MeshCentral is an open source remote device management server. If you run it, you should be on a current release anyway, since it handles remote access to your devices.
The record gives a CVSS score of 9.8 (Critical). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-295.
How to check if you're exposed
If you installed MeshCentral through npm, run npm ls meshcentral in the install directory. The server also shows its version in the web interface footer. Any deployment still on 1.1.16 should be updated.
Then review who can reach the server and the agent connection ports from outside.
What to do now
- Find MeshCentral servers and their versions.
- Upgrade to the latest release and read the release notes for security changes.
- Limit exposure of the server and its agent ports with a firewall.
- Review the devices and users the server controls, and rotate credentials if you suspect interception.
- Track the project's issues for further guidance on this CVE.
Why it matters
The weakness is improper certificate validation, CWE-295. When a program does not check that the certificate presented by the other side is genuine, anyone who can sit in the middle of the connection can pretend to be the real server or device.
For a remote management tool this matters a great deal. The tool exists to run actions on devices, so an attacker who can impersonate one end of a connection may read or change what passes through. The record's reference points to the file that handles the management server's connections.
The 9.8 score assumes the attacker can reach the service over the network without credentials. Your real exposure depends on how the server is deployed, but the sensible step is to update and to keep the service behind access controls.
Try it yourself
See how continuous monitoring re-checks your inventory when a new advisory lands.
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version?
The record does not name one. Use the latest MeshCentral release and read the release notes.
What does the weakness mean?
The software does not properly verify certificates, so a connection can be intercepted by someone posing as a trusted party.
Sources
Last reviewed: 19 October 2026.
