CVE-2024-47122

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47122
In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys stored on the EUD if physically compromised. This allows an attacker to decrypt all encrypted broadcast communications based on encryption keys stored on the EUD. This requires access to and control of the EUD, so it is recommended to use strong access control measures and layered encryption on the EUD for more secure operation.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:iphone_os:*:*
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:android:*:*
History

17 Oct 2024, 18:15

Type Values Removed Values Added
Summary (en) In the goTenna Pro application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted communications that include P2P, Group, and broadcast messages that use these keys. (en) In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys stored on the EUD if physically compromised. This allows an attacker to decrypt all encrypted broadcast communications based on encryption keys stored on the EUD. This requires access to and control of the EUD, so it is recommended to use strong access control measures and layered encryption on the EUD for more secure operation.

07 Oct 2024, 18:01

Type Values Removed Values Added
CPE cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:*:*:* cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:iphone_os:*:*
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:android:*:*

07 Oct 2024, 16:25

Type Values Removed Values Added
References () https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04 - () https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04 - Third Party Advisory, US Government Resource
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
First Time Gotenna
Gotenna gotenna Pro
CPE cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:*:*:*

30 Sep 2024, 12:46

Type Values Removed Values Added
Summary
  • (es) En la aplicación goTenna Pro, las claves de cifrado se almacenan junto con un IV estático en el dispositivo. Esto permite el descifrado completo de las claves almacenadas en el dispositivo. Esto permite que un atacante descifre todas las comunicaciones cifradas que incluyen mensajes P2P, grupales y de difusión que utilizan estas claves.

26 Sep 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-26 18:15

Updated : 2024-10-17 18:15

NVD link : CVE-2024-47122

Mitre link : CVE-2024-47122

CVE.ORG link : CVE-2024-47122

JSON object : View

Products Affected

gotenna

  • gotenna_pro
CWE
CWE-922

Insecure Storage of Sensitive Information