CVE Vulnerabilities

CVE-2024-47124

Cleartext Transmission of Sensitive Information

Published: Sep 26, 2024 | Modified: Oct 17, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using this and previous versions of the app and update your app to the current app version which uses AES-256 encryption for callsigns in encrypted operation.

Weakness

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Affected Software

Name Vendor Start Version End Version
Gotenna_pro Gotenna * 1.6.1 (including)
Gotenna_pro Gotenna * 2.0.3 (excluding)

Potential Mitigations

References