HIGH🇬🇧 English

CVE-2024-47130

CVSS 8.7v4.0pub. 2024-09-26upd. 2024-10-17

The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your app to the current release for enhanced encryption protocols.

oryginał EN
CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Gotenna Pro

    APP
    Gotenna
    ≤ 1.6.1< 2.0.3
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2024-47126HIGH7.1ten sam produkt

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The r...

CVE-2024-47125HIGH7.6ten sam produkt

The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate ...

CVE-2024-47123MEDIUM6.0ten sam produkt

The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integri...

CVE-2024-47129MEDIUM5.3ten sam produkt

The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messa...

CVE-2024-47122MEDIUM5.1ten sam produkt

In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). T...