Vulnerability identifier: #VU97905

Vulnerability risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45374

CWE-ID: CWE-521

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
ATAK Plugin
Web applications / Modules and components for CMS

Vendor: goTenna

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to weak password requirements for the QR broadcast message. A remote attacker on the local network can decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

ATAK Plugin: 1.9.12

---

External links
http://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.