CVE-2024-45723
goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator
The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.
Reserved 2024-09-24 | Published 2024-09-26 | Updated 2024-10-17 | Assigner icscertCWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Erwin Karincic, Clayton Smith, and Dale Wooden reported this these vulnerabilities to CISA.
www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
Support options
