CVE-2024-45374: goTenna Pro ATAK Plugin Weak Password Requirements
First published: Thu Sep 26 2024(Updated: )
The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is advised to use local QR encryption key sharing for additional security on this and previous versions.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| goTenna | <2.0.7 |
Remedy
goTenna recommends that users mitigate these vulnerabilities by performing the following updates: * ATAK Plugin: v2.0.7 or greater
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-45374?
CVE-2024-45374 is considered a high-severity vulnerability due to the risk of encryption key exposure.
How do I fix CVE-2024-45374?
To mitigate CVE-2024-45374, update the goTenna Pro ATAK plugin to a version that uses stronger password policies for key sharing.
What are the risks associated with CVE-2024-45374?
The risks include the potential for attackers to decrypt secured communications if they capture the broadcasted encryption key and successfully crack the weak password.
Which versions of goTenna are affected by CVE-2024-45374?
CVE-2024-45374 affects goTenna versions prior to 2.0.7.
What mitigations exist for CVE-2024-45374?
Mitigations include enhancing password policies and employing additional encryption methods for key broadcasts.
- agent/remedy
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- agent/weakness
- agent/title
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gotenna
- canonical/gotenna