PT-2024-32423 · Gotenna · Gotenna Pro X+2

Clayton Smith + 2 · Published 2024-09-26 · Updated 2024-10-17 · CVE-2024-47128

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions goTenna Pro App (affected versions not specified) goTenna Pro X (affected versions not specified) goTenna Pro X2 (affected versions not specified)

Description The goTenna Pro App encryption key name is sent unencrypted when shared over RF through a broadcast message, potentially revealing the location of operation. It is recommended to share the encryption key via local QR for higher security operations.

Recommendations For goTenna Pro App, consider sharing the encryption key via local QR instead of over RF through a broadcast message to minimize the risk of exploitation. For goTenna Pro X, consider sharing the encryption key via local QR instead of over RF through a broadcast message to minimize the risk of exploitation. For goTenna Pro X2, consider sharing the encryption key via local QR instead of over RF through a broadcast message to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2024-47128

Affected Products

Gotenna Pro App

Gotenna Pro X

Gotenna Pro X2

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-47128 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47128 · Vendor Advisory
• https://t.me/cvenotify/97088 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-270-04 · Note
• https://t.me/cvedetector/6446 · Telegram Post
• https://t.me/cvenotify/98606 · Telegram Post
• https://twitter.com/CVEnew/status/1839358129030799600 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1839367310320038198 · Twitter Post