CVE-2025-32881
📋 TL;DR
This vulnerability exposes users' phone numbers in goTenna v1 devices by transmitting them unencrypted as Group IDs (GIDs) in messages. Anyone using goTenna v1 devices with the specified app and firmware versions is affected, potentially allowing attackers to link communications to specific individuals.
💻 Affected Systems
- goTenna v1 devices
📦 What is this software?
Gotenna by Gotenna
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept communications, deanonymize users by linking phone numbers to identities, track individuals' movements and communications, and potentially conduct targeted social engineering or harassment campaigns.
Likely Case
Passive interception reveals users' phone numbers during normal mesh network communications, allowing basic identification and potential correlation with other data sources.
If Mitigated
With proper encryption or GID anonymization, only authorized participants can identify users, maintaining communication privacy.
🎯 Exploit Status
Exploitation requires physical proximity to intercept radio communications. The GitHub repository contains detailed analysis and proof of concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gotenna.com
Restart Required: No
Instructions:
1. Check goTenna website for security updates
2. Update app through official app store
3. Update device firmware if available
4. Consider disabling phone number as GID in settings
🔧 Temporary Workarounds
Disable Phone Number as GID
allManually opt out of using phone number as Group ID in app settings
Use Custom GID
allSet a custom, non-identifying Group ID instead of default phone number
🧯 If You Can't Patch
- Limit device use to non-sensitive communications only
- Physically secure devices to prevent unauthorized access to communications
🔍 How to Verify
Check if Vulnerable:
Check app version in settings (should be 5.5.3) and firmware version in device info (should be 0.25.5). Verify if phone number is being used as GID.Check Version:
Check within goTenna app settings for version informationVerify Fix Applied:
Confirm app and firmware versions are updated beyond vulnerable versions. Verify GID is not displaying phone number in messages.📡 Detection & Monitoring
Log Indicators:
- Unusual GID patterns in device logs
- Multiple failed GID modification attempts
Network Indicators:
- Intercepted radio communications containing phone numbers in cleartext
- Unusual mesh network traffic patterns
SIEM Query:
Not applicable for mesh network devices without centralized logging