CVE-2024-43108CWE-353

goTenna Pro ATAK Plugin Missing Support for Integrity Check

Medium · published September 26, 2024

CVSS v4.0
6.0
EPSS
0%
Percentile
0.4
In the wild
Unconfirmed
What it is

The goTenna Pro ATAK Plugin uses AES CTR type encryption for short,

encrypted messages without any additional integrity checking mechanisms.

This leaves messages malleable to an attacker that can access the

message. It is advised to continue to use encryption in the plugin and

update to the current release for enhanced encryption protocols.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00091 · 0.4th percentile
Weakness
CWE-353 · Missing Support for Integrity Check
Published
2024-09-26T17:28Z
EPSS history
Timeline
  • 26 SEP 17:28Z
    goTenna Pro ATAK Plugin Missing Support for Integrity Check
    cvelistv5