PT-2024-32416 · Gotenna · Gotenna Pro App +2

Name of the Vulnerable Software and Affected Versions: goTenna Pro App versions affected versions not specified goTenna Pro X goTenna Pro X2 Description: The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is capture...

CVE-2024-47128: Insertion of Sensitive Information Into Sent Data

The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations...

CVE-2024-45723: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast ...

PT-2024-32423

Name of the Vulnerable Software and Affected Versions goTenna Pro App affected versions not specified goTenna Pro X affected versions not specified goTenna Pro X2 affected versions not specified Description The goTenna Pro App encryption key name is sent unencrypted when shared over RF through a...

CVE-2024-47121: Weak Password Requirements

The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via...

goTenna Pro 安全漏洞

goTenna Pro is a series of devices from goTenna that create networks for off-grid communications and situational awareness. A security vulnerability exists in the goTenna Pro that stems from the use of a weak cipher for QR broadcast messages. If a QR broadcast message is captured via RF, it can b...

CVE-2024-47126: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an...

CVE-2024-45374: Weak Password Requirements

The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent vi...

CVE-2024-41931: Insertion of Sensitive Information Into Sent Data

The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations...

rf IDEAS MiCard PLUS Ci和MiCard PLUS BLE 安全漏洞

The rf IDEAS MiCard PLUS Ci and rf IDEAS MiCard PLUS BLE are both a card reader from rf IDEAS, Inc. in the USA. A security vulnerability exists in the rf IDEAS MiCard PLUS Ci and MiCard PLUS BLE that stems from a firmware failure that results in the assignment of an incorrect ID card number durin...

CVE-2024-1578: Improper Validation of Specified Type of Input

The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters randomly being dropped from some ID card reads, which would result in the wrong ID card number being assigned during ID card self-registration...

CVE-2024-37994

Siemens SIMATIC RFID Readers are affected by CVE-2024-37994. A hidden configuration item enables debug functionality, allowing an attacker to gain insight into internal deployment configuration. Affected devices include multiple RF610R/RF615R/RF650R/RF680R/RF685R families (CMIIT/ETSI/FCC/ARIB var...

CVE-2024-37993

The CVE-2024-37993 issue affects Siemens SIMATIC RFID Readers and related RF610R/615R/650R/680R/685R families (and associated components) across multiple harvestable variants. The root cause is improper access control: the affected applications do not authenticate the creation of Ajax2App instanc...

CVE-2024-37992

CVE-2024-37992 affects Siemens SIMATIC RFID Reader family (RF610R/RF615R/RF650R/RF680R/RF685R, RF1140R, RF1170R, RF166C, RF185C, RF186C/CI, RF188C/CI, RF360R). Root cause: improper handling of errors when exceeding characters during SNMP configuration, leading to application restart. Impact state...

CVE-2024-37990

Summary of CVE-2024-37990 (Siemens SIMATIC RFID Readers): A set of undocumented configuration commands in multiple SIMATIC RFID readers (RF610R/615R/650R/680R/685R, RF1140R/1170R, RF166C/185C/186C/188C/360R, etc.) can be modified by someone with privileged access to enable features not released f...

CVE-2024-37990: Hidden Functionality

A vulnerability has been identified in SIMATIC Reader RF610R CMIIT 6GT2811-6BC10-2AA0 All versions V4.2, SIMATIC Reader RF610R ETSI 6GT2811-6BC10-0AA0 All versions V4.2, SIMATIC Reader RF610R FCC 6GT2811-6BC10-1AA0 All versions V4.2, SIMATIC Reader RF615R CMIIT 6GT2811-6CC10-2AA0 All versions V4....

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Device Config Disclosure

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Device Config Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 0.01 Revision 0 Summary: The REBLE610 features an accurate hardware design, absence of internal cabling and full modularity. The unit is composed by a...

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Authentication Bypass

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 0.01 Revision 0 Summary: The REBLE610 features an accurate hardware design, absence of internal cabling and full modularity. The unit is composed...

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Insecure Direct Object Reference Vulnerability

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link suffers from an unauthenticated device configuration and client-side hidden functionality disclosure vulnerability. Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Device Config Vendor: Elber S.r.l. Product web page: https://www.elber.it...

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Authentication Bypass Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 0.01 Revision 0 Summary: The REBLE610 features an accurate hardware design, absence of internal cabling and full modularity. The unit is composed...