PT-2025-18671 · Gotenna · Gotenna Mesh

Published 2025-05-01 · Updated 2025-06-20 · CVE-2025-32884

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions goTenna Mesh versions 5.5.3 and firmware 1.1.12

Description A problem was discovered in goTenna Mesh devices where the GID, by default, is the user's phone number unless they opt out. Since a phone number can be associated with individuals, it is considered sensitive information. The application fails to encrypt the GID in messages, potentially exposing user information.

Recommendations For goTenna Mesh version 5.5.3 and firmware 1.1.12, consider disabling the default setting that uses the user's phone number as the GID to minimize the risk of sensitive information exposure. Users should opt out of using their phone number as the GID. Additionally, users should avoid using the application until a fix is provided that encrypts the GID in messages. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-32884

Affected Products

Gotenna Mesh

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-32884 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32884 · Vendor Advisory
• https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities · Note
• https://t.me/cvetracker/22836 · Telegram Post
• https://twitter.com/CVEnew/status/1918568513729602000 · Twitter Post
• https://t.me/cvenotify/126277 · Telegram Post
• https://gotenna.com · Note
• https://twitter.com/dailycve/status/1936150437251502306 · Twitter Post