Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-32860 State: PUBLISHED Published: 2025-04-16T17:38:43.055Z Last Updated: 2025-04-17T14:16:13.625Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockWebServerGatewaySettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A success
CVE ID: CVE-2025-32861 State: PUBLISHED Published: 2025-04-16T17:38:44.533Z Last Updated: 2025-04-17T14:16:05.840Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateTraceLevelSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful at
CVE ID: CVE-2025-32862 State: PUBLISHED Published: 2025-04-16T17:38:45.949Z Last Updated: 2025-04-17T14:15:56.995Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockTraceLevelSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful atta
CVE ID: CVE-2025-32863 State: PUBLISHED Published: 2025-04-16T17:38:47.349Z Last Updated: 2025-04-17T14:15:48.108Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockTraceLevelSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful at
CVE ID: CVE-2025-32864 State: PUBLISHED Published: 2025-04-16T17:38:48.731Z Last Updated: 2025-04-17T14:15:39.703Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires
CVE ID: CVE-2025-32865 State: PUBLISHED Published: 2025-04-16T17:38:50.158Z Last Updated: 2025-04-17T14:15:32.335Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateLog' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires t
e application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-32866 State: PUBLISHED Published: 2025-04-16T17:38:51.620Z Last Updated: 2025-04-17T14:15:24.860Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetLogs' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the
CVE ID: CVE-2025-32867 State: PUBLISHED Published: 2025-04-16T17:38:53.028Z Last Updated: 2025-04-17T14:15:15.038Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateBackup' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack require
CVE ID: CVE-2025-32868 State: PUBLISHED Published: 2025-04-16T17:38:54.410Z Last Updated: 2025-04-17T14:15:05.868Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ExportCertificate' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack re
CVE ID: CVE-2025-32869 State: PUBLISHED Published: 2025-04-16T17:38:55.788Z Last Updated: 2025-04-17T14:14:58.053Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ImportCertificate' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack re
CVE ID: CVE-2025-32870 State: PUBLISHED Published: 2025-04-16T17:38:57.182Z Last Updated: 2025-04-17T14:14:51.304Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetTraces' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires t
CVE ID: CVE-2025-32871 State: PUBLISHED Published: 2025-04-16T17:38:58.559Z Last Updated: 2025-04-17T14:14:44.243Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'MigrateDatabase' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requ
CVE ID: CVE-2025-32872 State: PUBLISHED Published: 2025-04-16T17:39:00.326Z Last Updated: 2025-04-17T14:14:36.389Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetOverview' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires
CVE ID: CVE-2025-32873 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-08T14:42:25.501Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: djangoproject Products: Django Problem Types: CWE-770 Description: An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
vulnerable, because it is built on top of strip_tags(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/g/django-announce - https://www.djangoproject.com/weblog/2025/may/07/security-releases/
CVE ID: CVE-2025-32874 State: PUBLISHED Published: 2025-07-16T00:00:00.000Z Last Updated: 2025-11-24T15:25:43.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A vulnerability exists in the EncryptionUtil class because symmetric encryption is implemented in a deterministic and non-randomized fashion. The method Encrypt(byte[] clearData) derives both the encryption key and the IV from a fixed, hardcoded input by using a static salt value. As a result, identical plaintext inputs always produce identical ciphertext outputs. This is true for both FIPS and non-FIPS generated passwords. In other wo
ts always produce identical ciphertext outputs. This is true for both FIPS and non-FIPS generated passwords. In other words, there is a cryptographic implementation flaw in the password encryption mechanism. Although there are multiple encryption methods grouped under FIPS and non-FIPS classifications, the logic consistently results in predictable and reversible encrypted outputs due to the lack of per-operation randomness and encryption authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://galacticadvisors.com - https://codykretsinger.com - https://www.galacticadvisors.com/release/critical-vulnerabilities-in-network-detective/ - https://www.galacticadvisor
- https://www.galacticadvisors.com/release/critical-vulnerabilities-in-network-detective/ - https://www.galacticadvisors.com/release/cve/
CVE ID: CVE-2025-32875 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-23T15:04:47.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any data transmitted via BLE remains unencrypted, allowing attackers within Bluetooth range to eavesdrop on the communication. Furthermore, even if a user manually initiates pairing and bonding in the Android settings, the application continues to transmit data without requiring the watch t
es pairing and bonding in the Android settings, the application continues to transmit data without requiring the watch to be bonded. This fallback behavior enables attackers to exploit the communication, for example, by conducting an active machine-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://support.coros.com/hc/en-us/categories/4416357319956-Software-Updates - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-025.txt
CVE ID: CVE-2025-32876 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-24T15:27:06.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and instead enforces BLE Legacy Pairing. In BLE Legacy Pairing, the Short-Term Key (STK) can be easily guessed. This requires knowledge of the Temporary Key (TK), which, in the case of the COROS Pace 3, is set to 0 due to the Just Works pairing method. An attacker within Bluetooth range can therefore perform sniffing attacks, allowing eavesdropping on the communication. A
n attacker within Bluetooth range can therefore perform sniffing attacks, allowing eavesdropping on the communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-023.txt
CVE ID: CVE-2025-32877 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-24T15:26:31.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the use of the Just Works pairing method. This method does not implement any authentication, which therefore allows machine-in-the-middle attacks. Furthermore, this lack of authentication allows attackers to interact with the device via BLE without requiring prior authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://s
uiring prior authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-024.txt
CVE ID: CVE-2025-32878 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-20T14:49:41.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is mainly for downloading firmware files. Before downloading firmware files, the watch requests some information about the firmware via HTTPS from the back-end API. However, the X.509 server certificate within the TLS handshake is not validated by the device. This allows an attacker within an active machine-in-the-middle position, using a TLS proxy and a self-signed certificate, to eave
ws an attacker within an active machine-in-the-middle position, using a TLS proxy and a self-signed certificate, to eavesdrop and manipulate the HTTPS communication. This could be abused, for example, for stealing the API access token of the assigned user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-030.txt
CVE ID: CVE-2025-32879 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-24T13:47:58.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device require any authentication or security level. Therefore, any characteristic, depending on their mode of operation (read/write/notify), can be used by the connected attacker. This allows, for example, configuring the device, sendi
tion (read/write/notify), can be used by the connected attacker. This allows, for example, configuring the device, sending notifications, resetting the device to factory settings, or installing software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-026.txt
CVE ID: CVE-2025-32880 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-24T15:27:48.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted and allows sniffing and machine-in-the-middle attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://support.coros.com/hc/en-us/articles/20087694119828-COROS-PACE-3-Release-Notes - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisorie
-us/articles/20087694119828-COROS-PACE-3-Release-Notes - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-029.txt
CVE ID: CVE-2025-32881 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T19:52:45.382Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless they specifically opt out. A phone number is very sensitive information because it can be tied back to individuals. The app does not encrypt the GID in messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities
CVE ID: CVE-2025-32882 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T19:49:08.079Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:H/AV:A/A:N/C:N/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app uses a custom implementation of encryption without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities
CVE ID: CVE-2025-32883 State: REJECTED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-09T19:52:22.759Z Description: No description available.
CVE ID: CVE-2025-32884 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T19:33:18.573Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. By default, a GID is the user's phone number unless they specifically opt out. A phone number is very sensitive information because it can be tied back to individuals. The app does not encrypt the GID in messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities
CVE ID: CVE-2025-32885 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T19:28:49.157Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:A/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https:
already been compromised. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities
CVE ID: CVE-2025-32886 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T19:26:19.888Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. All packets sent over RF are also sent over UART with USB Shell, allowing someone with local access to gain information about the protocol and intercept sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities
CVE ID: CVE-2025-32887 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T19:19:41.743Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AC:L/AV:A/A:H/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be intercepted and used to break frequency hopping. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities
CVE ID: CVE-2025-32888 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T19:11:36.218Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AC:L/AV:L/A:H/C:L/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. The verification token used for sending SMS through a goTenna server is hardcoded in the app. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities
CVE ID: CVE-2025-32889 State: PUBLISHED Published: 2025-05-01T00:00:00.000Z Last Updated: 2025-05-01T18:52:25.319Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AC:L/AV:L/A:H/C:L/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The verification token used for sending SMS through a goTenna server is hardcoded in the app. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gotenna.com - https://github.com/Dollarhyde/goTenna_v1_and_Mesh_vulnerabilities