PT-2024-30298 · Gotenna · Gotenna Pro Atak Plugin

Clayton Smith + 2 · Published 2024-09-26 · Updated 2024-10-17 · CVE-2024-43108

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions goTenna Pro ATAK Plugin (affected versions not specified)

Description The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message.

Recommendations Update to the current release for enhanced encryption protocols. As a temporary workaround, consider using additional integrity checking mechanisms to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

CWE-353

Related Identifiers

CVE-2024-43108

Affected Products

Gotenna Pro Atak Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2024-43108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43108 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-270-05 · Note
• https://t.me/cvenotify/96211 · Telegram Post
• https://t.me/cvenotify/98582 · Telegram Post
• https://t.me/cvenotify/97349 · Telegram Post
• https://twitter.com/CVEnew/status/1839358130289062106 · Twitter Post