PT-2024-31741 · Gotenna · Gotenna Pro Atak Plugin

Clayton Smith + 2 · Published 2024-09-26 · Updated 2024-10-17 · CVE-2024-45723

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: goTenna Pro ATAK Plugin (affected versions not specified)

Description: The issue is related to the generation of passwords for sharing cryptographic keys, where the goTenna Pro ATAK Plugin does not utilize SecureRandom. Instead, it uses a random function that is not suitable for cryptographic purposes, making it easier for attackers to brute force the password if the broadcasted encryption key is captured. This primarily affects the optional broadcast of an encryption key, and it is recommended to share the key via a local QR code for higher security operations.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2024-45723

Affected Products

Gotenna Pro Atak Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-45723 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45723 · Vendor Advisory
• https://twitter.com/CVEnew/status/1839362120376303703 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-270-05 · Note
• https://t.me/cvenotify/98584 · Telegram Post
• https://t.me/cvenotify/96216 · Telegram Post