CVE-2024-43814

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-43814
The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is active and goTenna is connected. Users that are unaware of their settings and have not activated encryption before a mission may accidentally broadcast their location unencrypted. It is advised to verify PLI settings are the desired rate and activate encryption prior to mission. Update to the latest Plugin to disable this default setting.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:gotenna:gotenna:*:*:*:*:*:atak:*:*
History

17 Oct 2024, 18:15

Type Values Removed Values Added
Summary (en) goTenna Pro ATAK Plugin by default enables frequent unencrypted Position, Location and Information (PLI) transmission. This transmission is done without user's knowledge, revealing the exact location transmitted in unencrypted form. (en) The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is active and goTenna is connected. Users that are unaware of their settings and have not activated encryption before a mission may accidentally broadcast their location unencrypted. It is advised to verify PLI settings are the desired rate and activate encryption prior to mission. Update to the latest Plugin to disable this default setting.

07 Oct 2024, 19:37

Type Values Removed Values Added
CPE cpe:2.3:a:gotenna:gotenna:*:*:*:*:*:atak:*:*
CWE NVD-CWE-Other
First Time Gotenna
Gotenna gotenna
References () https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 - () https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 - Third Party Advisory, US Government Resource

30 Sep 2024, 12:46

Type Values Removed Values Added
Summary
  • (es) El complemento ATAK de goTenna Pro permite de forma predeterminada la transmisión frecuente de información de posición, ubicación e información (PLI) sin cifrar. Esta transmisión se realiza sin el conocimiento del usuario y revela la ubicación exacta transmitida sin cifrar.

26 Sep 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-26 18:15

Updated : 2024-10-17 18:15

NVD link : CVE-2024-43814

Mitre link : CVE-2024-43814

CVE.ORG link : CVE-2024-43814

JSON object : View

Products Affected

gotenna

  • gotenna
CWE
NVD-CWE-Other CWE-201

Insertion of Sensitive Information Into Sent Data