Gotenna Pro Atak Plugin
9 CVEs affecting Gotenna Pro Atak Plugin. Latest disclosed: 2024-09-26. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45723 | Medium | 6.5 | 2024-09-26 | The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier fo… |
CVE-2024-41722 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software define… |
CVE-2024-45374 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over… |
CVE-2024-43108 | Medium | 5.3 | 2024-09-26 | The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves mess… |
CVE-2024-45838 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous… |
CVE-2024-43814 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is a… |
CVE-2024-43694 | Medium | 4.3 | 2024-09-26 | In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys… |
CVE-2024-41931 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share t… |
CVE-2024-41715 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the… |