PT-2024-32424 · Gotenna · Gotenna Pro X+2

Clayton Smith + 2 · Published 2024-09-26 · Updated 2024-10-17 · CVE-2024-47129

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions goTenna Pro App (affected versions not specified) goTenna Pro X and Pro X2 (affected versions not specified)

Description The issue is related to the goTenna Pro App not injecting extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.

Recommendations For goTenna Pro App, consider implementing a payload length obfuscation mechanism to prevent attackers from determining the length of the payload. For goTenna Pro X and Pro X2, consider implementing a payload length obfuscation mechanism to prevent attackers from determining the length of the payload. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2024-47129

Affected Products

Gotenna Pro App

Gotenna Pro X

Gotenna Pro X2

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-47129 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47129 · Vendor Advisory
• https://t.me/cvenotify/98607 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1839368590736204123 · Twitter Post
• https://twitter.com/CVEnew/status/1839358127923487039 · Twitter Post
• https://t.me/cvenotify/97065 · Telegram Post
• https://t.me/cvedetector/6447 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-270-04 · Note