CVE-2024-47126CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro

High · published September 26, 2024

CVSS v4.0
7.1
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

The goTenna Pro App does not use SecureRandom when generating passwords

for sharing cryptographic keys. The random function in use makes it

easier for attackers to brute force this password if the broadcasted

encryption key is captured over RF. This only applies to the optional

broadcast of an encryption key, so it is advised to share the key with

local QR code for higher security operations.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00238 · 14.1th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2024-09-26T17:26Z
EPSS history
Timeline
  • 26 SEP 17:26Z
    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro
    cvelistv5