PT-2025-18688 · Gotenna · Gotenna Mesh

Published 2025-05-01 · Updated 2025-06-20 · CVE-2025-32888

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions goTenna Mesh versions 5.5.3 with firmware 1.1.12

Description A problem was discovered in goTenna Mesh devices where the verification token used for sending SMS through a goTenna server is hardcoded in the application. This issue affects devices with app version 5.5.3 and firmware version 1.1.12.

Recommendations For goTenna Mesh version 5.5.3 with firmware 1.1.12, consider restricting access to the hardcoded verification token until a patch is available. As a temporary workaround, avoid using the affected application for sending SMS through a goTenna server until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-32888

Affected Products

Gotenna Mesh

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-32888 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32888 · Vendor Advisory
• https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities · Note
• https://t.me/cvenotify/126281 · Telegram Post
• https://twitter.com/dailycve/status/1936158837326692599 · Twitter Post
• https://t.me/cvetracker/22840 · Telegram Post
• https://t.me/latest_high_impact_cve/2250 · Telegram Post
• https://twitter.com/MfersFTW/status/1919712386350776824 · Twitter Post
• https://twitter.com/cybercronai/status/1918482050496987409 · Twitter Post
• https://gotenna.com · Note
• https://twitter.com/CVEnew/status/1918568517819089281 · Twitter Post