CVE-2024-47123

Oct. 17, 2024, 6:15 p.m.

3.1
Low

Description

The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is recommended to continue to use encryption in the app and update to the current release for more secure operations.

Product(s) Impacted

Vendor Product Versions
Gotenna
  • Gotenna Pro
  • *

Weaknesses

CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-353
Missing Support for Integrity Check
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

*CPE(s)

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a gotenna gotenna_pro / / / / / iphone_os / /
a gotenna gotenna_pro / / / / / android / /

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

Tags

ics-cert@hq.dhs.gov
CWE-345
CWE-353
2024-09-26
CVE-2024-47123

CVSS Score

3.1 / 10

CVSS Data

  • Attack Vector: ADJACENT_NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE
    • View Vector String

    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Date

  • Published: Sept. 26, 2024, 6:15 p.m.
  • Last Modified: Oct. 17, 2024, 6:15 p.m.

Status : Modified

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

ics-cert@hq.dhs.gov

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.