Cryptographic Key Generation Vulnerability in goTenna Pro Series
CVE-2024-47126

8.8HIGH

Key Information:

Vendor

Gotenna

Status
Pro
Vendor
CVE Published:
26 September 2024

What is CVE-2024-47126?

The goTenna Pro App contains a vulnerability due to the lack of SecureRandom in its password generation process for cryptographic key sharing. This weakness enables attackers to exploit the predictable random function used, making it feasible to perform brute force attacks on the password if an encryption key is intercepted over radio frequencies. This issue arises specifically when the encryption key is shared through broadcasting, emphasizing the importance of utilizing alternate methods such as local QR code sharing for enhanced security during key distribution.

Affected Version(s)

Pro 0 <= 1.61

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-2...
government-resource

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwin Karincic, Clayton Smith, and Dale Wooden reported this these vulnerabilities to CISA.
.
CVE-2024-47126 : Cryptographic Key Generation Vulnerability in goTenna Pro Series