PT-2025-18669 · Gotenna · Gotenna

Published 2025-05-01 · Updated 2025-06-20 · CVE-2025-32882

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions goTenna v1 with application 5.5.3 and firmware 0.25.5

Description The issue concerns the use of a custom encryption implementation in the application without additional integrity checking mechanisms. This makes messages vulnerable to an attacker who can access them, allowing the messages to be modified.

Recommendations For goTenna v1 devices with application 5.5.3 and firmware 0.25.5, consider disabling the custom encryption implementation until a secure alternative with integrity checking mechanisms is available. Restrict access to sensitive messages to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-353

Related Identifiers

CVE-2025-32882

Affected Products

Gotenna

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-32882 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32882 · Vendor Advisory
• https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities · Note
• https://twitter.com/dailycve/status/1936162334797398036 · Twitter Post
• https://twitter.com/CVEnew/status/1918568511804497920 · Twitter Post
• https://gotenna.com · Note
• https://t.me/cvenotify/126276 · Telegram Post
• https://t.me/cvetracker/22834 · Telegram Post