Hardcoded Verification Token in goTenna v1 Devices Causing Security Risk
CVE-2025-32889

7.3HIGH

Key Information:

Vendor

goTenna

Status
goTenna v1
Vendor
CVE Published:
1 May 2025

What is CVE-2025-32889?

A security flaw has been identified in goTenna v1 devices, specifically in the app version 5.5.3 and firmware version 0.25.5, where the verification token for sending SMS through the goTenna server is hardcoded in the application. This exposes users to potential security threats, allowing attackers to exploit the hardcoded token to execute unauthorized actions. Such vulnerabilities can lead to unauthorized access to communications, making it essential for users to be aware of this issue and prompt the adoption of best practices for secure application usage.

References

https://gotenna.com
https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnera...

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.