Location Leak: goTenna Pro Broadcast Key Sent Unencrypted
CVE-2024-47128

4.3MEDIUM

Key Information:

Vendor

Gotenna

Status
Pro
Vendor
CVE Published:
26 September 2024

What is CVE-2024-47128?

The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations.

Affected Version(s)

Pro 0 <= 1.61

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-2...
government-resource

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwin Karincic, Clayton Smith, and Dale Wooden reported this these vulnerabilities to CISA.
.