PT-2025-18670 · Gotenna · Gotenna Mesh

Published 2025-05-01 · Updated 2025-05-03 · CVE-2025-32883

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AC:L/AV:A/A:N/C:H/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions goTenna Mesh versions 5.5.3 and firmware 1.1.12

Description An issue was discovered that allows the injection of custom messages into existing mesh networks with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised.

Recommendations For goTenna Mesh version 5.5.3 and firmware 1.1.12, consider disabling the use of software defined radio functionality until a patch is available to prevent custom message injection. Restrict access to unencrypted environments to minimize the risk of exploitation. Ensure cryptography is not compromised to prevent exploitation of this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1390

Related Identifiers

CVE-2025-32883

Affected Products

Gotenna Mesh

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-32883 · Security Note
• https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities · Note
• https://t.me/cvetracker/22835 · Telegram Post
• https://gotenna.com · Note
• https://twitter.com/CVEnew/status/1918568512794316932 · Twitter Post