Medium severity · published Sep 26, 2024
CVE-2024-45723
goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator
6.5
CVSS
0.1%
EPSS
No
On KEV
Description
The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Pro ATAK Plugin · goTenna
through 1.9.12 · source: vendor, CISA
GO
Gotenna · Gotenna
before 2.0.7 · source: NVD
Affected product
PA
Pro ATAK Plugin
goTenna
More from Pro ATAK Plugin
6.5
CVE-2024-41722
goTenna Pro ATAK Plugin Weak Authentication
6.5
CVE-2024-43108
goTenna Pro ATAK Plugin Missing Support for Integrity Check
6.5
CVE-2024-43694
goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information
6.5
CVE-2024-45374
goTenna Pro ATAK Plugin Weak Password Requirements
4.3
CVE-2024-43814
goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data