CVE-2024-47127 - CVE House
Back to Database
Status published Medium CVE-2024-47127

Weak Authentication in goTenna Pro

Vulnerability Description

In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised. It is advised to share encryption keys via QR scanning for higher security operations and update your app to the current release for enhanced encryption protocols.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47127

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Erwin Karincic, Clayton Smith, and Dale Wooden reported this these vulnerabilities to CISA.

References

More from goTenna

View All →
CVE-2024-47130
Missing Authentication for Critical Function in goTenna Pro
High 8.7
CVE-2024-47129
Observable Response Discrepancy in goTenna Pro
Medium 5.3
CVE-2024-47128
Insertion of Sensitive Information Into Sent Data in goTenna Pro
Medium 5.3
CVE-2024-47126
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro
High 7.1
CVE-2024-47125
Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro
High 7.6

Affected Vendor

Affected Software

Pro
Vulnerable Versions:
0

Timeline

Official Publish: September 26th, 2024
Last Modified: October 17th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-1390

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.