CVE-2024-41722

In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised. It is advised to use encryption shared with local QR code for higher security operations.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:gotenna:gotenna:*:*:*:*:*:atak:*:*

History

17 Oct 2024, 17:15

Type	Values Removed	Values Added
Summary	(en) In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing gotenna mesh networks. This vulnerability can be exploited if the device is being used in a unencrypted environment or if the cryptography has already been compromised.	(en) In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised. It is advised to use encryption shared with local QR code for higher security operations.

07 Oct 2024, 19:35

Type	Values Removed	Values Added
CPE		cpe:2.3:a:gotenna:gotenna::::::atak::*
CWE		NVD-CWE-Other
First Time		Gotenna Gotenna gotenna
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 - Third Party Advisory, US Government Resource

30 Sep 2024, 12:46

Type	Values Removed	Values Added
Summary		(es) En el complemento ATAK de goTenna Pro existe una vulnerabilidad que permite inyectar cualquier mensaje personalizado con cualquier GID y Callsign utilizando una radio definida por software en redes en malla de GoTenna existentes. Esta vulnerabilidad se puede explotar si el dispositivo se utiliza en un entorno no cifrado o si la criptografía ya se ha visto comprometida.

26 Sep 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-26 18:15

Updated : 2024-10-17 17:15

NVD link : CVE-2024-41722

Mitre link : CVE-2024-41722

CVE.ORG link : CVE-2024-41722

JSON object : View

Products Affected

gotenna

gotenna

CWE

NVD-CWE-Other CWE-1390

Weak Authentication

6.5 /10