CVE-2024-43108
goTenna Pro ATAK Plugin Missing Support for Integrity Check
- State
- Published
- Severity
- 6.0 Medium
- Published
- Sep 26, 2024
- Updated
- Oct 17, 2024
- Reserved
- Sep 24, 2024
Description
The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is advised to continue to use encryption in the plugin and update to the current release for enhanced encryption protocols.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.0 Medium | CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | icscert |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Pro ATAK PlugingoTenna |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.