CVE-2025-32886

An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. All packets sent over RF are also sent over UART with USB Shell, allowing someone with local access to gain information about the protocol and intercept sensitive data.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities	Third Party Advisory
https://gotenna.com	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:gotenna:mesh_firmware:0.25.5:*:*:*:*:*:*:*

cpe:2.3:h:gotenna:mesh:-:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:gotenna:gotenna:5.5.3:*:*:*:*:-:*:*

History

20 Jun 2025, 16:45

Type	Values Removed	Values Added
CPE		cpe:2.3:a:gotenna:gotenna:5.5.3:::::-:: cpe:2.3:h:gotenna:mesh:-:::::::* cpe:2.3:o:gotenna:mesh_firmware:0.25.5:::::::*
References	~~() https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities -~~	() https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities - Third Party Advisory
References	~~() https://gotenna.com -~~	() https://gotenna.com - Product
First Time		Gotenna gotenna Gotenna mesh Firmware Gotenna Gotenna mesh

02 May 2025, 13:52

Type	Values Removed	Values Added
Summary		(es) Se detectó un problema en dispositivos goTenna v1 con la aplicación 5.5.3 y el firmware 0.25.5. Todos los paquetes enviados por RF también se envían por UART con USB Shell, lo que permite que alguien con acceso local obtenga información sobre el protocolo e intercepte datos confidenciales.

01 May 2025, 20:15

Type	Values Removed	Values Added
CWE		CWE-923

01 May 2025, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-01 18:15

Updated : 2025-06-20 16:45

NVD link : CVE-2025-32886

Mitre link : CVE-2025-32886

CVE.ORG link : CVE-2025-32886

JSON object : View

Products Affected

gotenna

mesh
mesh_firmware
gotenna

CWE

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

{"id": "CVE-2025-32886", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-05-01T18:15:55.800", "references": [{"url": "https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gotenna.com", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-923"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. All packets sent over RF are also sent over UART with USB Shell, allowing someone with local access to gain information about the protocol and intercept sensitive data."}, {"lang": "es", "value": "Se detect\u00f3 un problema en dispositivos goTenna v1 con la aplicaci\u00f3n 5.5.3 y el firmware 0.25.5. Todos los paquetes enviados por RF tambi\u00e9n se env\u00edan por UART con USB Shell, lo que permite que alguien con acceso local obtenga informaci\u00f3n sobre el protocolo e intercepte datos confidenciales."}], "lastModified": "2025-06-20T16:45:10.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:gotenna:mesh_firmware:0.25.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92602326-09B2-46F8-ACB7-F977942C191D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:gotenna:mesh:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B188A17B-CCB4-438C-A370-5913AB3BB22A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gotenna:gotenna:5.5.3:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "63D278BB-4BE6-4020-9D7C-CB774101087A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}