CVE-2024-45723CWE-338

goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator

High · published September 26, 2024

CVSS v4.0
7.1
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

The goTenna Pro ATAK Plugin does not use SecureRandom when generating

passwords for sharing cryptographic keys. The random function in use

makes it easier for attackers to brute force this password if the

broadcasted encryption key is captured over RF. This only applies to the

optional broadcast of an encryption key, so it is advised to share the

key with local QR code for higher security operations.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00143 · 3.2th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2024-09-26T17:37Z
EPSS history
Timeline
  • 26 SEP 17:37Z
    goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator
    cvelistv5