CVE-2024-45838 MEDIUM

CVE-2024-45838: goTenna Pro ATAK Plugin Cleartext Transmission of Sensitive Information

Vendor Gotenna
Product Pro ATAK Plugin
Weakness CWE-319 · Cleartext transmission
Published September 26, 2024
Last update October 17, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous versions of the plugin. Update to current plugin version which uses AES-256 encryption for callsigns in encrypted operation

Key dates

02Disclosure timeline

September 26, 2024 CVE published
October 17, 2024 Record updated