CVE-2024-43108

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is advised to continue to use encryption in the plugin and update to the current release for enhanced encryption protocols.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-353 CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-43115.4zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An atta CVE-2024-431108.8The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM tha CVE-2024-431116.1Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Fi CVE-2024-431126.1Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129 CVE-2024-431136.1The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129 CVE-2024-431147.8In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions CVE-2024-431158.8Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert scrip CVE-2024-431168.8Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.1 CVE-2024-431178.8Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This is CVE-2024-431188.8Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects CVE-2024-431194.3Missing Authorization vulnerability in Aruba.It Aruba HiSpeed Cache allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2024-43124.3The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and