CVE-2024-45723 goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator

High 7.1 Published 26 Sep 2024 Updated 17 Oct 2024

Weak random number generation in goTenna Pro ATAK Plugin allows attackers to brute force shared encryption keys if broadcasted over RF.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-45723?

CVE-2024-45723 is a high-severity vulnerability in goTenna Pro ATAK Plugin, published on 26 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.

Weakness: CWE-338

Which versions are affected by CVE-2024-45723?

It affects 1 product.

Products include Gotenna Gotenna.

How do I fix CVE-2024-45723?

No fix has been published for CVE-2024-45723 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-45723 being exploited?

There is no known exploitation of CVE-2024-45723 in the wild and no public exploit code.

Sources

Also known as GHSA-rgqq-jvq6-w93r.