CVE-2024-47129 Observable Response Discrepancy in goTenna Pro

The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used...

CVE-2024-47129 Observable Response Discrepancy in goTenna Pro

The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used...

CVE-2024-47129

CVE-2024-47129 (goTenna) describes an Observable Response Discrepancy in the goTenna Pro App family where extra characters are not injected into broadcast frames to obfuscate payload length. This allows an observer to determine the length of the payload regardless of encryption. Supported by mult...

CVE-2024-47128 Insertion of Sensitive Information Into Sent Data in goTenna Pro

The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations...

CVE-2024-47128 Insertion of Sensitive Information Into Sent Data in goTenna Pro

The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations...

CVE-2024-47128

The CVE-2024-47128 issue affects goTenna Pro/Pro X series apps. The root cause is that the encryption key name is broadcast unencrypted over RF, potentially exposing sensitive information. Documented impact centers on confidentiality risk to broadcasted data, with remediation guidance to share ke...

CVE-2024-43108 goTenna Pro ATAK Plugin Missing Support for Integrity Check

The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is advised to continue to use encryption in the plugin and update to the curre...

CVE-2024-43108

CVE-2024-43108 affects the goTenna Pro ATAK Plugin. The vulnerability is due to AES-CTR encryption for short messages without any integrity checking, making messages malleable to an attacker who can access the message. Affected versions include 1.9.12 and earlier; mitigation guidance recommends u...

CVE-2024-43108 goTenna Pro ATAK Plugin Missing Support for Integrity Check

The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is advised to continue to use encryption in the plugin and update to the curre...

CVE-2024-47127 Weak Authentication in goTenna Pro

In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the...

CVE-2024-47127

CVE-2024-47127 affects goTenna Pro App (and Pro X/Pro X2 ecosystems). A vulnerability described across connected documents allows injecting arbitrary messages with any GID/Callsign into existing goTenna mesh networks via a software-defined radio, applicable when encryption is absent or cryptograp...

CVE-2024-47127 Weak Authentication in goTenna Pro

In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the...

CVE-2024-47126 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an...

CVE-2024-47126 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an...

CVE-2024-47126

CVE-2024-47126 is confirmed via connected sources as a vulnerability in the goTenna Pro ecosystem where the app does not use SecureRandom when generating passwords to share cryptographic keys. The underlying flaw is a weak PRNG in the key-sharing flow, enabling a potential brute-force attack if t...

CVE-2024-43694 goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information

In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based on broadcast keys stored on the device...

CVE-2024-43694 goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information

In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based on broadcast keys stored on the device...

CVE-2024-47125

CVE-2024-47125 affects goTenna Pro App (versions up to 1.6.1). The underlying issue is improper authentication of public keys, allowing an unauthenticated attacker to manipulate messages (attack vector: adjacent, low complexity, no user interaction). MITRE details in ICS/Red Hat/NVD entries corro...

CVE-2024-47125 Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro

The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to the current release for enhanced encryption protocols...

CVE-2024-47125 Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro

The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to the current release for enhanced encryption protocols...