PT-2024-30676 · Gotenna · Gotenna Pro Atak Plugin

Clayton Smith + 2 · Published 2024-09-26 · Updated 2024-10-17 · CVE-2024-43814

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions goTenna Pro ATAK Plugin (affected versions not specified)

Description The goTenna Pro ATAK Plugin has a default setting to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is active and goTenna is connected. This can lead to users accidentally broadcasting their location unencrypted if they are unaware of their settings and have not activated encryption before a mission.

Recommendations Update to the latest Plugin to disable the default setting of sharing PLI updates every 60 seconds. As a temporary workaround, consider verifying PLI settings to the desired rate and activate encryption prior to mission. Restrict access to the plugin's default settings to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2024-43814

Affected Products

Gotenna Pro Atak Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2024-43814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43814 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-270-05 · Note
• https://t.me/cvenotify/98598 · Telegram Post
• https://t.me/cvenotify/96213 · Telegram Post
• https://twitter.com/CVEnew/status/1839369790445740219 · Twitter Post
• https://t.me/cvenotify/97351 · Telegram Post