CVE-2024-43694 MEDIUM

CVE-2024-43694: goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information

Vendor Gotenna
Product Pro ATAK Plugin
Weakness CWE-922
Published September 26, 2024
Last update September 26, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Physical
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based on broadcast keys stored on the device.

Key dates

02Disclosure timeline

September 26, 2024 CVE published
September 26, 2024 Record updated