CVE-2024-45374 - CVE House
Back to Database
Status published Medium CVE-2024-45374

goTenna Pro ATAK Plugin Weak Password Requirements

Vulnerability Description

The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is advised to use local QR encryption key sharing for additional security on this and previous versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45374

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Erwin Karincic, Clayton Smith, and Dale Wooden reported this these vulnerabilities to CISA.

References

More from goTenna

View All →
CVE-2024-47130
Missing Authentication for Critical Function in goTenna Pro
High 8.7
CVE-2024-47129
Observable Response Discrepancy in goTenna Pro
Medium 5.3
CVE-2024-47128
Insertion of Sensitive Information Into Sent Data in goTenna Pro
Medium 5.3
CVE-2024-47127
Weak Authentication in goTenna Pro
Medium 6
CVE-2024-47126
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro
High 7.1

Affected Vendor

Affected Software

Pro ATAK Plugin
Vulnerable Versions:
0

Timeline

Official Publish: September 26th, 2024
Last Modified: March 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-521

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.