goTenna Mesh Cleartext Transmission of Sensitive Information Vulnerability

A vulnerability exists in goTenna Mesh devices running the goTenna App version 5.5.3 and firmware 1.1.12. By default, the Group ID (GID) assigned to users is their phone number, unless they opt out. This default setting exposes sensitive personal information that can be linked to individuals. Furthermore, the application fails to encrypt the GID when transmitted in messages, leaving it vulnerable to interception.

Impact

Exploitation of this vulnerability allows for the cleartext transmission of sensitive information, specifically the user's phone number, which can be intercepted and potentially misused.