Main Vulnerability Database Vulnerabilities #VU97771

Missing support for integrity check in goTenna Pro App for iOS and goTenna Pro App for Android - CVE-2024-47123

Published: September 30, 2024

Vulnerability identifier: #VU97771

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-47123

CWE-ID: CWE-353

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected application uses AES CTR mode for short, encrypted messages without any additional integrity checking mechanisms. A remote attacker on the local network can access the messages and cause them to be malleable.

Affected software

goTenna Pro App for iOS
goTenna Pro App for Android

How to mitigate CVE-2024-47123

Install updates from vendor's website.

goTenna Pro App for Android - update to 2.0.3

External References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

Related Security Bulletins