CVE-2024-47124: Cleartext Transmission of Sensitive Information in goTenna Pro
First published: Thu Sep 26 2024(Updated: )
The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous versions of the app and update your app to the current app version which uses AES-256 encryption for callsigns in encrypted operation.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| goTenna Pro | <=1.6.1 | |
| Gotenna Pro | <2.0.3 |
Remedy
goTenna recommends that users mitigate these vulnerabilities by performing the following updates: * Android Pro: v2.0.3 or greater * iOS Pro: v2.0.3 or greater
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-47124?
CVE-2024-47124 is considered a medium severity vulnerability due to its potential exposure of sensitive information.
How do I fix CVE-2024-47124?
To fix CVE-2024-47124, update the goTenna Pro App to the latest version which implements AES-256 encryption for callsigns.
What versions of goTenna Pro are affected by CVE-2024-47124?
CVE-2024-47124 affects goTenna Pro versions up to 1.6.1 on iPhone OS and versions prior to 2.0.3 on Android.
What data is exposed in CVE-2024-47124?
CVE-2024-47124 exposes callsigns in messages, which can lead to the leakage of sensitive information.
Is it safe to use sensitive information in callsigns with the vulnerable versions of goTenna Pro?
It is not safe to use sensitive information in callsigns with the vulnerable versions of goTenna Pro.
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/author
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/event
- agent/severity
- agent/last-modified-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gotenna
- canonical/gotenna pro
- version/gotenna pro/1.6.1