CVE-2025-32889
📋 TL;DR
This vulnerability allows attackers to send SMS messages through goTenna servers without authorization by using a hardcoded verification token in the app. It affects goTenna v1 device users running app version 5.5.3 with firmware 0.25.5. The hardcoded token bypasses authentication mechanisms for SMS functionality.
💻 Affected Systems
- goTenna v1 devices
📦 What is this software?
Gotenna by Gotenna
⚠️ Risk & Real-World Impact
Worst Case
Attackers could send unlimited SMS messages through goTenna infrastructure, incurring significant costs for the company and potentially enabling spam, phishing, or harassment campaigns using the compromised service.
Likely Case
Unauthorized SMS sending leading to service abuse, potential financial losses for goTenna, and reputational damage from malicious messages appearing to originate from their service.
If Mitigated
Limited impact if token is rotated or SMS functionality is disabled, though legacy devices may remain vulnerable if not updated.
🎯 Exploit Status
The hardcoded token can be extracted from the app and used directly without authentication. Public GitHub repository demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gotenna.com
Restart Required: No
Instructions:
1. Check goTenna website for security updates. 2. Update app if newer version is available. 3. Update device firmware if newer version is available. 4. Contact goTenna support for specific guidance.
🔧 Temporary Workarounds
Disable SMS functionality
allTurn off SMS sending capabilities in the app settings if available
Network restriction
allBlock outbound SMS traffic from goTenna devices at network level
🧯 If You Can't Patch
- Isolate goTenna devices on separate network segments
- Monitor for unusual SMS traffic patterns from goTenna infrastructure
🔍 How to Verify
Check if Vulnerable:
Check app version in settings (5.5.3) and firmware version in device info (0.25.5)Check Version:
Check within goTenna app settings under 'About' or 'Device Info'Verify Fix Applied:
Verify app and firmware versions have been updated beyond vulnerable versions📡 Detection & Monitoring
Log Indicators:
- Unusual SMS sending patterns
- Failed authentication attempts for SMS services
Network Indicators:
- SMS traffic from unauthorized sources
- Traffic to goTenna SMS API without proper authentication
SIEM Query:
source="gotenna" AND (event_type="sms_send" OR protocol="sms") AND NOT user_authenticated=true