CVE-2025-32884
📋 TL;DR
goTenna Mesh devices with vulnerable app/firmware versions transmit user phone numbers unencrypted in messages by default. This allows attackers intercepting communications to link device activity to specific individuals. Users who haven't opted out of phone number-based GIDs are affected.
💻 Affected Systems
- goTenna Mesh devices
📦 What is this software?
Gotenna by Gotenna
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept communications and deanonymize users, enabling targeted surveillance, harassment, or linking communications to real identities.
Likely Case
Passive interception reveals user identities and communication patterns, compromising privacy in mesh network communications.
If Mitigated
With proper opt-out configuration and network segmentation, impact limited to metadata exposure without personal identifiers.
🎯 Exploit Status
Exploitation requires intercepting mesh network communications; no authentication needed to read unencrypted GID field
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: https://gotenna.com
Restart Required: No
Instructions:
1. Check goTenna website for security updates
2. Update app and firmware when available
3. Manually opt out of phone number GID in app settings
🔧 Temporary Workarounds
Opt out of phone number GID
allChange GID from default phone number to custom identifier
Disable vulnerable versions
allStop using app 5.5.3 with firmware 1.1.12 combination
🧯 If You Can't Patch
- Immediately opt out of phone number GID in app settings
- Limit use of vulnerable devices to non-sensitive communications only
🔍 How to Verify
Check if Vulnerable:
Check app version in settings (5.5.3) and firmware version (1.1.12) in device infoCheck Version:
N/A - check via mobile app interfaceVerify Fix Applied:
Verify GID in messages shows custom identifier instead of phone number📡 Detection & Monitoring
Log Indicators:
- Unencrypted GID fields in message logs containing phone number patterns
Network Indicators:
- Cleartext transmission of numeric identifiers in mesh protocol
SIEM Query:
N/A - primarily requires physical/logical network monitoring