CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43814 – goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data
https://notcve.org/view.php?id=CVE-2024-43814
goTenna Pro ATAK Plugin by default enables frequent unencrypted Position, Location and Information (PLI) transmission. This transmission is done without user's knowledge, revealing the exact location transmitted in unencrypted form. The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is active and goTenna is connected. Users that are unaware of their settings and have not activated encryption before a mission may accidentally broadcast their location unencrypted. It is advised to verify PLI settings are the desired rate and activate encryption prior to mission. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 • CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41715 – goTenna Pro ATAK Plugin Observable Response Discrepancy
https://notcve.org/view.php?id=CVE-2024-41715
The goTenna Pro ATAK Plugin has a payload length vulnerability that makes it possible to tell the length of the payload regardless of the encryption used. The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 • CWE-204: Observable Response Discrepancy •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41931 – goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data
https://notcve.org/view.php?id=CVE-2024-41931
The goTenna Pro ATAK Plugin broadcast key name is always sent unencrypted and could reveal the location of operation. The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 • CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41722 – goTenna Pro ATAK Plugin Weak Authentication
https://notcve.org/view.php?id=CVE-2024-41722
In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing gotenna mesh networks. This vulnerability can be exploited if the device is being used in a unencrypted environment or if the cryptography has already been compromised. In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised. It is advised to use encryption shared with local QR code for higher security operations. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 • CWE-1390: Weak Authentication •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45723 – goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator
https://notcve.org/view.php?id=CVE-2024-45723
The goTenna Pro ATAK Plugin does not use SecureRandom when generating its cryptographic keys. The random function in use is not suitable for cryptographic use. The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •