CVE-2024-43694

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based on broadcast keys stored on the device.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-922

Affected software

Vendor	Product	Versions
goTenna	Pro ATAK Plugin	<= 1.9.12
gotenna	pro_atak_plugin	<= 1.9.12

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05Third Party Advisory, US Government Resource

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-436965.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak.CVE-2024-436975.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input.CVE-2024-436989.8Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system.CVE-2024-436999.8Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to e CVE-2024-43705.4The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widg CVE-2024-437007.8xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow CVE-2024-437017.8Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.CVE-2024-437028.1Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical CVE-2024-437038.1Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physic CVE-2024-437048.4Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent CVE-2024-437057.8Software installed and run as a non-privileged user can trigger the GPU kernel driver to write to arbitrary read-only system files that have CVE-2024-437068.8Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.