// For flags

CVE-2022-24401

Keystream recovery for arbitrary frames in TETRA

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of these counters in a mobile station, provoking keystream re-use. By sending crafted messages to the MS and analyzing MS responses, keystream for arbitrary frames can be recovered.

Reutilización del flujo de claves inducida por el adversario en el tráfico cifrado de interfaz aérea TETRA utilizando cualquier generador de flujo de claves TEA. La generación IV se basa en varios contadores de frame TDMA, que frecuentemente la infraestructura transmite sin autenticación. Un adversario activo puede manipular la vista de estos contadores en una estación móvil, provocando la reutilización del flujo de claves. Al enviar mensajes manipulados al MS y analizar las respuestas del MS, se puede recuperar el flujo de claves de frames arbitrarios.

*Credits: Midnight Blue
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-04 CVE Reserved
  • 2023-10-19 CVE Published
  • 2023-10-26 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-323: Reusing a Nonce, Key Pair in Encryption
  • CWE-639: Authorization Bypass Through User-Controlled Key
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://tetraburst.com 2023-11-07
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Midnightblue
Search vendor "Midnightblue"
Tetra:burst
Search vendor "Midnightblue" for product "Tetra:burst"
--
Affected