goTenna V1 and Mesh Frequency Hopping Vulnerability

A vulnerability exists in goTenna V1 devices running app version 5.5.3 and firmware 0.25.5. The issue arises from a command channel that transmits the next hop information in cleartext, which can be intercepted and used to disrupt the device's frequency hopping mechanism. This vulnerability was reported to goTenna in 2017 and 2018, but the company discontinued support for goTenna V1 and goTenna Mesh devices in 2024.

Impact

Exploitation of this vulnerability allows for interception of command channel information, which can be used to break the device's frequency hopping, potentially leading to communication disruptions.