CVE-2024-47121

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47121

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

T

he goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is recommended to use local QR encryption key sharing for additional security on this and previous versions.

References
Link Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:android:*:*
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:iphone_os:*:*
History

01 Nov 2024, 20:39

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.5 		v2 : unknown
v3 : 5.3
CPE cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:*:*:* cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:iphone_os:*:*
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:android:*:*

17 Oct 2024, 18:15

Type Values Removed Values Added
Summary (en) The goTenna Pro series uses a weak password for the QR broadcast message. If the QR broadcast message is captured over RF it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast. (en) The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is recommended to use local QR encryption key sharing for additional security on this and previous versions.

07 Oct 2024, 16:27

Type Values Removed Values Added
References () https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04 - () https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04 - Third Party Advisory, US Government Resource
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:*:*:*
First Time Gotenna
Gotenna gotenna Pro

30 Sep 2024, 12:46

Type Values Removed Values Added
Summary
  • (es) La serie goTenna Pro utiliza una contraseña débil para el mensaje de transmisión QR. Si el mensaje de transmisión QR se captura mediante RF, es posible descifrarlo y utilizarlo para descifrar todos los mensajes futuros y pasados enviados mediante transmisión cifrada.

26 Sep 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-26 18:15

Updated : 2024-11-01 20:39

NVD link : CVE-2024-47121

Mitre link : CVE-2024-47121

CVE.ORG link : CVE-2024-47121

JSON object : View

Products Affected

gotenna

CWE
CWE-521

Weak Password Requirements