CVE-2025-32890 | Medium | 5.3 | 2025-05-01 | An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. It uses a custom implementation of encryption without any additional integr… |
CVE-2025-32889 | High | 7.3 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The verification token used for sending SMS through a goTenna server is hardc… |
CVE-2025-32888 | High | 7.3 | 2025-05-01 | An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. The verification token used for sending SMS through a goTenna server is har… |
CVE-2025-32887 | High | 7.1 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be intercepted and used to… |
CVE-2025-32886 | Medium | 4.0 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. All packets sent over RF are also sent over UART with USB Shell, allowing som… |
CVE-2025-32885 | Medium | 6.5 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v… |
CVE-2025-32884 | Medium | 4.3 | 2025-05-01 | An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's phone number unless they specifically opt o… |
CVE-2025-32882 | Medium | 5.3 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app uses a custom implementation of encryption without any additional int… |
CVE-2025-32881 | Medium | 4.3 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless they specifically opt o… |
CVE-2024-47130 | High | 8.8 | 2024-09-26 | The goTenna Pro App allows unauthenticated attackers to remotely update
the local public keys used for P2P and group messages. It is advised to
update your a… |
CVE-2024-47129 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not inject extra characters into broadcasted
frames to obfuscate the length of messages. This makes it possible to
tell the length o… |
CVE-2024-47128 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App encryption key name is always sent unencrypted when
the key is shared over RF through a broadcast message. It is advised to
share the enc… |
CVE-2024-47127 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro App there is a vulnerability that makes it possible
to inject any custom message with any GID and Callsign using a software
defined radio… |
CVE-2024-47126 | Medium | 6.5 | 2024-09-26 | The goTenna Pro App does not use SecureRandom when generating passwords
for sharing cryptographic keys. The random function in use makes it
easier for attack… |
CVE-2024-47125 | High | 8.1 | 2024-09-26 | The goTenna Pro App does not authenticate public keys which allows an
unauthenticated attacker to manipulate messages. It is advised to update
your app to th… |
CVE-2024-47124 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not encrypt callsigns in messages. It is
recommended to not use sensitive information in callsigns when using
this and previous vers… |
CVE-2024-47123 | Medium | 5.3 | 2024-09-26 | The goTenna Pro App uses AES CTR type encryption for short, encrypted
messages without any additional integrity checking mechanisms. This
leaves messages mal… |
CVE-2024-47122 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro App, the encryption keys are stored along with a
static IV on the End User Device (EUD). This allows for complete
decryption of keys store… |
CVE-2024-47121 | Medium | 5.3 | 2024-09-26 | The goTenna Pro App uses a weak password for sharing encryption keys via
the key broadcast method. If the broadcasted encryption key is captured
over RF, and… |
CVE-2024-45838 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It
is advised to not use sensitive information in callsigns when using this
and previous… |
CVE-2024-45723 | Medium | 6.5 | 2024-09-26 | The goTenna Pro ATAK Plugin does not use SecureRandom when generating
passwords for sharing cryptographic keys. The random function in use
makes it easier fo… |
CVE-2024-45374 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK plugin uses a weak password for sharing encryption
keys via the key broadcast method. If the broadcasted encryption key is
captured over… |
CVE-2024-43814 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin's default settings are to share Automatic
Position, Location, and Information (PLI) updates every 60 seconds once
the plugin is a… |
CVE-2024-43694 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro ATAK Plugin application, the encryption keys are
stored along with a static IV on the device. This allows for complete
decryption of keys… |
CVE-2024-43108 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK Plugin uses AES CTR type encryption for short,
encrypted messages without any additional integrity checking mechanisms.
This leaves mess… |
CVE-2024-41931 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin encryption key name is always sent
unencrypted when the key is sent over RF through a broadcast message. It
is advised to share t… |
CVE-2024-41722 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro ATAK Plugin there is a vulnerability that makes it
possible to inject any custom message with any GID and Callsign using a
software define… |
CVE-2024-41715 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not inject extra characters into
broadcasted frames to obfuscate the length of messages. This makes it
possible to tell the… |