7.1

CVE-2024-45723

goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator

The goTenna Pro ATAK Plugin does not use SecureRandom when generating 
passwords for sharing cryptographic keys. The random function in use 
makes it easier for attackers to brute force this password if the 
broadcasted encryption key is captured over RF. This only applies to the
 optional broadcast of an encryption key, so it is advised to share the 
key with local QR code for higher security operations.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gotenna ≫ Gotenna SwPlatformatak Version < 2.0.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.037
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ics-cert@hq.dhs.gov 7.1 0 0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ics-cert@hq.dhs.gov 6.5 2.8 3.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
Third Party Advisory
US Government Resource