CVE-2025-32890 identifies a vulnerability in goTenna Mesh devices running app version 5.5.3 and firmware 1.1.12. The core issue stems from the device's use of a custom encryption implementation that lacks additional integrity checking mechanisms, such as message authentication codes (MACs) or digital signatures. This cryptographic design flaw allows an attacker who can access the encrypted messages to perform malleability attacks, meaning they can alter the ciphertext in a way that predictably changes the decrypted plaintext without needing to decrypt the message themselves. Since the encryption does not verify message integrity, the device will accept and process these manipulated messages as valid. The vulnerability is classified under CWE-353, which relates to missing integrity checks in security-critical operations. According to the CVSS 3.1 vector, the attack complexity is high (AC:H), requiring adjacent network access (AV:A), with no privileges or user interaction needed. The impact affects message integrity (I:H) but does not affect confidentiality or availability. No known exploits are currently reported in the wild, and no patches have been published yet. The vulnerability was reserved in April 2025 and published in May 2025, indicating it is a recent discovery. The goTenna Mesh devices are used for decentralized, off-grid communication, often in remote or tactical environments, relying on peer-to-peer radio mesh networking. The lack of integrity verification in encrypted messages could allow attackers to inject or modify messages, potentially causing misinformation, disruption of communication, or manipulation of device behavior within the mesh network.

For European organizations, particularly those relying on goTenna Mesh devices for secure, off-grid communication—such as emergency services, disaster response teams, outdoor expedition groups, or defense-related entities—this vulnerability poses a significant risk to message integrity. Attackers with access to the mesh network could alter messages, leading to misinformation or miscoordination during critical operations. Although confidentiality is not compromised, the ability to tamper with messages can undermine trust in the communication system and potentially disrupt coordinated activities. Since the attack requires adjacency to the network, physical proximity or network access is necessary, somewhat limiting the attack surface. However, in sensitive operational contexts, even limited message manipulation can have outsized consequences. The absence of patches means organizations must rely on mitigation strategies until official fixes are released. The medium CVSS score reflects the moderate severity but does not diminish the operational impact in scenarios where message integrity is paramount.

1. Network Segmentation and Physical Security: Restrict physical and network access to goTenna Mesh devices to trusted personnel only. Deploy devices in controlled environments to reduce the risk of an attacker gaining adjacency to the mesh network. 2. Monitoring and Anomaly Detection: Implement monitoring solutions to detect unusual message patterns or unexpected behavior within the mesh network that could indicate message tampering. 3. Operational Procedures: Train users to verify critical information through multiple channels when possible, especially in high-stakes scenarios, to mitigate the impact of manipulated messages. 4. Firmware and App Updates: Maintain close communication with the device vendor or community to obtain and apply patches or updates as soon as they become available. 5. Supplementary Integrity Checks: Where feasible, implement additional application-layer integrity verification mechanisms, such as digital signatures or HMACs, on messages before transmission through the mesh network. This may require custom development or integration efforts. 6. Limit Sensitive Communications: Avoid transmitting highly sensitive or critical commands solely over the goTenna Mesh network until the vulnerability is addressed, or use alternative secure communication methods in parallel.