VulnerabilityAnalyzed

CVE-2025-32885

The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined radio.

MEDIUM 6.5EPSS 0.22%

Does this matter?

Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.22% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-1390
Affected: gotenna/mesh firmware · gotenna/gotenna
Source: cve@mitre.org

References

https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilitiesThird Party Advisory
https://gotenna.comProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.