CVE Feed

    Dashboard / CVE / CVE-2025-32890

    CVE-2025-32890

    An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. It uses a custom implementation of encryption without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message.

    Published:May 1, 2025
    Last Modified:Jun 20, 2025
    EPS:May 1, 2025
    EPSS Score:0.0001
    CVSS Score:5.3

    Affected Products

    Vendor
    Gotenna
    Product
    Gotenna
    Vendor
    Gotenna
    Product
    Mesh
    Vendor
    Gotenna
    Product
    Mesh Firmware

    Exploits

    https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities

    Related CVEs

    CVE-2025-32881 (CVSS 4.3) — An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the u…
    CVE-2025-32889 (CVSS 7.3) — An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The verification token used …
    CVE-2025-32888 (CVSS 7.3) — An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. The verification token use…
    CVE-2025-32887 (CVSS 7.1) — An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes t…
    CVE-2025-32884 (CVSS 4.3) — An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the u…
    CVE-2025-32886 (CVSS 4) — An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. All packets sent over RF are…
    CVE-2025-32882 (CVSS 5.3) — An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app uses a custom implem…
    CVE-2025-32885 (CVSS 6.5) — An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possi…
    CVE-2024-43814 (CVSS 5.3) — The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PL…
    CVE-2024-41931 (CVSS 5.3) — The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF throu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High