CVE-2024-45723
Medium
Description
The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.
SeverityMedium
CVSS6.5
Exploit probability—
ProductGotenna
PublishedSep 26, 2024
First seenSep 26, 2024
Weakness typeCWE-338CWE-338
How to fix
Update
- gotenna gotenna2.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gotenna gotenna | v < 2.0.7 | 2.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.