PT-2024-32416 · Gotenna · Gotenna Pro X+2

Clayton Smith

+2

·

Published

2024-09-26

·

Updated

2024-11-02

·

CVE-2024-47121

CVSS v3.1

5.3

Medium

VectorAV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions goTenna Pro App versions (affected versions not specified) goTenna Pro X goTenna Pro X2
Description The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and the password is cracked via a brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF.
Recommendations For goTenna Pro App, consider using local QR encryption key sharing for additional security. For goTenna Pro X, use local QR encryption key sharing for additional security. For goTenna Pro X2, use local QR encryption key sharing for additional security. As a temporary workaround, consider disabling the key broadcast method until a patch is available. Restrict access to the key broadcast feature to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2024-47121

Affected Products

Gotenna Pro App
Gotenna Pro X
Gotenna Pro X2