CVE-2023-51838 is a use of a broken or risky cryptographic algorithm in Ylianst MeshCentral 1.1.16. The record rates it High at 7.5, with a confidentiality impact. No fixed version is named, so update to the current release and read the project's notes.
What's affected
The record names MeshCentral 1.1.16. It does not list a fixed version, and the sources we reached do not state one, so check the project's release notes for the first release that addresses it.
MeshCentral is an open source remote device management server. If you run it, you should be on a current release anyway, since it handles remote access to your devices.
The record gives a CVSS score of 7.5 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity none, and on availability none. The weakness class is CWE-327.
How to check if you're exposed
If you installed MeshCentral through npm, run npm ls meshcentral in the install directory. The server also shows its version in the web interface footer. Any deployment still on 1.1.16 should be updated.
Then review who can reach the server and the agent connection ports from outside.
What to do now
- Find MeshCentral servers and their versions.
- Upgrade to the latest release and read the release notes for security changes.
- Limit exposure of the server and its agent ports with a firewall.
- Review the devices and users the server controls, and rotate credentials if you suspect interception.
- Track the project's issues for further guidance on this CVE.
Why it matters
The weakness is the use of a broken or risky cryptographic algorithm, CWE-327. The software relies on an algorithm that is known to be weak, so data protected by it may be read by someone who captures it.
The record does not say which algorithm or which data. The researcher's write-up in a repository of cryptographic misuse findings covers the detail, and we advise reading it directly. The score reflects an impact on confidentiality with no integrity or availability effect.
For a tool that manages remote devices, protecting the secrets that cross the wire is central. Keep the server current and limit who can see its traffic.
If you run MeshCentral, it is worth reviewing the whole deployment against the project's hardening guidance and release notes, not only this CVE. Related findings were published against the same version, including a certificate validation issue, and fixing them together saves a second round of change control.
Quick check
What is affected?
MeshCentral 1.1.16 is named in the record.
Is a fix named?
No. Use the latest release and check the release notes.
Sources
Last reviewed: 19 October 2026.
