CVE-2025-32884

Executive Summary

CVE-2025-32884 exposes a critical privacy flaw in goTenna Mesh devices (app version 5.3.3, firmware 1.1.12). By default, the Group ID (GID) is set to the user’s phone number unless the user explicitly opts out. The application does not encrypt the GID in transmitted messages, allowing any adversary within radio range to capture and associate a phone number with a specific device. This leakage of personally identifiable information (PII) enables de-anonymization, tracking, and potential social engineering attacks. The vulnerability is currently unpatched, and no public exploit code exists.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects proprietary firmware and mobile applications for goTenna Mesh devices.

CVSS Breakdown & Threat Level

CVSS Score: 4.3 (Medium) Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• Attack Vector (AV): Adjacent Network – The attacker must be within radio range of the goTenna Mesh network.
• Attack Complexity (AC): Low – No special conditions required; the GID is transmitted in plaintext.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required for exploitation.
• Scope (S): Unchanged – The vulnerability only affects the confidentiality of the GID.
• Confidentiality (C): Low – Only the phone number (GID) is exposed.
• Integrity (I): None – No data modification.
• Availability (A): None – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the real-world impact is significant due to the sensitivity of phone numbers and the ease of passive sniffing.

Deep Dive & Mechanics

The goTenna Mesh device creates a mesh network where each node is identified by a Group ID (GID). The default configuration sets the GID to the user’s phone number. This GID is included in the header of every message transmitted over the mesh network without encryption.

Attack Scenario:

1. An attacker with a software-defined radio (SDR) or a second goTenna device within range passively captures mesh packets.
2. The attacker extracts the GID field from the packet headers.
3. The GID (phone number) is then linked to the device’s other metadata (e.g., location, message content if unencrypted).
4. The attacker can now map phone numbers to physical locations or use the number for phishing/social engineering.

Technical Detail: The GID is transmitted in the clear as part of the mesh protocol’s addressing scheme. The protocol does not implement any encryption for this field, even when message payloads may be encrypted. This design flaw violates the principle of least privilege and exposes PII by default.

Vulnerable vs. Patched Code

Vulnerable Code (goTenna Mesh app 5.5.3 / firmware 1.1.12): The GID is set to the device’s phone number by default. The following pseudocode illustrates the vulnerable behavior:

def get_gid():
    if not user_opted_out:
        return phone_number
    else:
        return random_gid()

Patched Code (Hypothetical): A patch would require the GID to be a random, non-identifiable value by default, and optionally allow the user to set a custom GID. The GID should be encrypted in transit.

def get_gid():
    if not user_set_custom_gid:
        return generate_random_gid()
    else:
        return custom_gid

def encrypt_gid(gid, session_key):
    return aes_encrypt(gid, session_key)

No official patch is available as of this report.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Two goTenna Mesh devices (one victim, one attacker) with app 5.5.3 and firmware 1.1.12.
• A laptop with a compatible SDR (e.g., HackRF One) and Wireshark or custom packet sniffer.
• Python environment with scapy for packet parsing.

Exploitation Steps:

1. Place the attacker device within radio range of the victim device.
2. Use the SDR to capture raw mesh packets.
3. Parse the packets to extract the GID field.
4. The GID is the victim’s phone number.

Example Python script to extract GID:

from scapy.all import *

def extract_gid(packet):
    # Assuming goTenna Mesh packet structure
    if packet.haslayer(Raw):
        raw_data = packet[Raw].load
        # GID is at offset 10-19 (10 bytes)
        gid = raw_data[10:20].decode('utf-8', errors='ignore')
        return gid
    return None

# Capture packets
packets = sniff(iface="wlan0", count=100)
for pkt in packets:
    gid = extract_gid(pkt)
    if gid:
        print(f"Captured GID: {gid}")

Blue Team (Defensive)

Detection:

• Monitor for unexpected goTenna Mesh devices in the area.
• Use spectrum analyzers to detect anomalous mesh traffic.
• Implement network segmentation to isolate goTenna devices from sensitive networks.

Mitigation:

• Immediately change the GID to a random value in the app settings.
• Educate users to opt out of using their phone number as GID.
• Monitor for any unauthorized devices attempting to join the mesh.

Indicators of Compromise (IOCs)

• Network: Unencrypted goTenna Mesh packets containing a 10-digit numeric GID (phone number).
• Device: goTenna Mesh device with default GID set to phone number.
• Traffic Pattern: Repeated mesh discovery packets from unknown devices within radio range.

Example IOC in PCAP:

Frame: ... 
Raw: ... GID=5551234567 ...

Detection Engineering

YARA Rule

rule goTenna_GID_Leak {
    meta:
        description = "Detects goTenna Mesh packets containing unencrypted phone number GID"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32884"
    strings:
        $gid_pattern = /GID=\d{10}/
    condition:
        $gid_pattern
}

Sigma Rule

title: goTenna Mesh GID Leak Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unencrypted phone number GID in goTenna Mesh traffic
author: Valters IT
date: 2025/04/10
logsource:
    category: network_traffic
    product: wireshark
detection:
    selection:
        raw_data|contains: 'GID='
    condition: selection
falsepositives:
    - Legitimate goTenna Mesh traffic with custom GID
level: high

Suricata Rule

alert tcp any any -> any any (msg:"goTenna Mesh GID Leak Detected"; content:"GID="; depth:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change GID: In the goTenna Mesh app, navigate to Settings > Group ID and change it to a random, non-identifiable value.
2. Opt Out: Ensure the "Use Phone Number as GID" option is disabled.
3. User Training: Inform all users about the privacy risk and how to change their GID.

Long-Term Fixes:

• Vendor Patch: goTenna must release a firmware update that encrypts the GID field and defaults to a random GID.
• Protocol Update: Implement end-to-end encryption for all metadata, including GIDs.
• Network Monitoring: Deploy detection rules (YARA, Sigma, Suricata) to identify GID leakage.

Workarounds:

• Use a separate, non-identifying GID for each session.
• Limit the range of the mesh network to reduce exposure.

Valters IT
Securing the Mesh, One Packet at a Time.