Vulnerability identifier: #VU97906

Vulnerability risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-43694

CWE-ID: CWE-922

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
ATAK Plugin
Web applications / Modules and components for CMS

Vendor: goTenna

Description

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to the encryption keys are stored along with a static IV on the device. An authenticated attacker with physical access can decrypt all encrypted broadcast communications based on broadcast keys stored on the device.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

ATAK Plugin: 1.9.12

---

External links
http://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.