PT-2025-18689 · Gotenna · Gotenna

Published 2025-05-01 · Updated 2025-06-20 · CVE-2025-32889

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions goTenna v1 devices with app version 5.5.3 and firmware version 0.25.5

Description An issue was discovered where the verification token used for sending SMS through a goTenna server is hardcoded in the app. This affects the ability to securely send SMS messages.

Recommendations For goTenna v1 devices with app version 5.5.3 and firmware version 0.25.5, consider restricting access to the SMS sending functionality until a patch is available that removes the hardcoded verification token. As a temporary workaround, avoid using the affected app version to send SMS messages through a goTenna server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-32889

Affected Products

Gotenna

References · 9

• https://osv.dev/vulnerability/CVE-2025-32889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32889 · Security Note
• https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities · Note
• https://twitter.com/CVEnew/status/1918568518792216937 · Twitter Post
• https://t.me/cvetracker/22841 · Telegram Post
• https://t.me/cvenotify/126282 · Telegram Post
• https://twitter.com/cybercronai/status/1918489567746818100 · Twitter Post
• https://t.me/latest_high_impact_cve/2250 · Telegram Post
• https://gotenna.com · Note