CVE-2024-45374
Last modified
CVE-2024-45374 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. EPSS estimates a 0.12% chance of exploitation in the next 30 days.
Description
The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is advised to use local QR encryption key sharing for additional security on this and previous versions.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gotenna | Gotenna | < 2.0.7 |
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-45374?
How severe is CVE-2024-45374?
How do I fix CVE-2024-45374?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-45369The web application uses a weak authentication mechanism to …9.2
- CVE-2024-4537IDOR vulnerability in Janto Ticketing Software affecting ver…7.5
- CVE-2024-45370An authentication bypass vulnerability exists in the User pr…7.3
- CVE-2024-45371Improper access control for some Intel(R) Arc™ & Iris(R)…6.7
- CVE-2024-45372MZK-DP300N firmware versions 1.04 and earlier contains a cro…6.5
- CVE-2024-45373Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user…8.8
- CVE-2024-4538IDOR vulnerability in Janto Ticketing Software affecting ver…7.5
- CVE-2024-45380Rejected reason: This candidate was in a CNA pool that was n…
- CVE-2024-45382in OpenHarmony v4.1.0 and prior versions allow a local attac…5.5
- CVE-2024-45383A mishandling of IRP requests vulnerability exists in the HD…5
- CVE-2024-45384Padding Oracle vulnerability in Apache Druid extension, drui…5.3
- CVE-2024-45385A vulnerability has been identified in Industrial Edge Manag…6.1
Are you affected by CVE-2024-45374?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST