CVE-2024-47123

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is recommended to continue to use encryption in the app and update to the current release for more secure operations.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-353 CWE-345

Affected software

Vendor	Product	Versions
goTenna	Pro	<= 1.61

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04Third Party Advisory, US Government Resource

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-471246.5The goTenna Pro App does not encrypt callsigns in messages. It is recommended to not use sensitive information in callsigns when using thi CVE-2024-471255.4The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to upd CVE-2024-471268.8The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it CVE-2024-471273.1In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a softw CVE-2024-471284.3The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advise CVE-2024-471294.3The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to CVE-2024-47136.1A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerabi CVE-2024-471306.5The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advise CVE-2024-471317.8If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer over CVE-2024-471337.2UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrat CVE-2024-471347.8Out-of-bounds write vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 an CVE-2024-471357.8Stack-based buffer overflow vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6