PT-2024-32419 · Gotenna · Gotenna Pro App

Clayton Smith + 2 · Published 2024-09-26 · Updated 2024-10-17 · CVE-2024-47124

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions goTenna Pro App versions prior to the current app version

Description The issue concerns the lack of encryption for callsigns in messages. This could potentially reveal sensitive information about users and may be leveraged for other vulnerabilities. It is recommended not to use sensitive information in callsigns when using affected versions of the app. The current app version uses AES-256 encryption for callsigns in encrypted operation.

Recommendations Update the app to the current version, which uses AES-256 encryption for callsigns in encrypted operation. As a temporary workaround, consider not using sensitive information in callsigns until the app is updated.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2024-47124

Affected Products

Gotenna Pro App

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-47124 · Security Note
• https://t.me/cvenotify/97299 · Telegram Post
• https://twitter.com/CVEnew/status/1839358138140774513 · Twitter Post
• https://t.me/cvedetector/6442 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-270-04 · Note
• https://twitter.com/VulmonFeeds/status/1839364749487751434 · Twitter Post
• https://t.me/cvenotify/98602 · Telegram Post