Vulnerabilities > Gotenna > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-26 | CVE-2024-41715 | Information Exposure Through Discrepancy vulnerability in Gotenna Atak Plugin The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. | 4.3 |
| 2024-09-26 | CVE-2024-41722 | Unspecified vulnerability in Gotenna In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. low complexity gotenna | 6.5 |
| 2024-09-26 | CVE-2024-41931 | Unspecified vulnerability in Gotenna The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. low complexity gotenna | 4.3 |
| 2024-09-26 | CVE-2024-43108 | Insufficient Verification of Data Authenticity vulnerability in Gotenna The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. | 6.5 |
| 2024-09-26 | CVE-2024-43694 | Insecure Storage of Sensitive Information vulnerability in Gotenna Atak Plugin In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. | 6.5 |
| 2024-09-26 | CVE-2024-43814 | Unspecified vulnerability in Gotenna The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is active and goTenna is connected. low complexity gotenna | 4.3 |
| 2024-09-26 | CVE-2024-45374 | Insecure Storage of Sensitive Information vulnerability in Gotenna The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. | 6.5 |
| 2024-09-26 | CVE-2024-45723 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Gotenna The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. | 6.5 |
| 2024-09-26 | CVE-2024-45838 | Cleartext Transmission of Sensitive Information vulnerability in Gotenna The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. | 4.3 |
| 2024-09-26 | CVE-2024-47121 | Weak Password Requirements vulnerability in Gotenna PRO The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. | 5.3 |