CVE-2024-41715

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204 CWE-203

Affected software

Vendor	Product	Versions
goTenna	Pro ATAK Plugin	<= 1.9.12

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05Third Party Advisory, US Government Resource

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-417168.1Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker CVE-2024-417179.8Kieback & Peter's DDC4000 series is vulnerable to a path traversal vulnerability, which may allow an unauthenticated attacker to read files CVE-2024-417195.5When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-CVE-2024-41724.3A vulnerability classified as problematic was found in idcCMS 1.35. Affected by this vulnerability is an unknown functionality of the file /CVE-2024-417208.0Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow CVE-2024-417218.1An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbi CVE-2024-417226.5In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using CVE-2024-417234.3Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached CVE-2024-417248.7Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. CVE-2024-417256.1ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site sc CVE-2024-417267.5Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary e CVE-2024-417277.5In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traff