Vendors / goTenna Records 28 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 7
Exploited now goTenna records in CISA KEV No goTenna vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority LOW 39
The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages.
CVSS 4.0 HIGH 8.7· Adjacent network · No auth · No interaction · EPSS 0.00216 · Published 2024-09-26 · No fix listed CWE-306
Priority LOW 34
The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages.
CVSS 4.0 HIGH 7.6· Adjacent network · No auth · No interaction · EPSS 0.00142 · Published 2024-09-26 · No fix listed CWE-923
Priority LOW 33
The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys.
CVSS 4.0 HIGH 7.1· Adjacent network · No auth · No interaction · EPSS 0.00238 · Published 2024-09-26 · No fix listed CWE-338
Priority LOW 26
In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks.
CVSS 4.0 MEDIUM 6.0· Adjacent network · No auth · No interaction · EPSS 0.00114 · Published 2024-09-26 · No fix listed CWE-1390
Priority LOW 26
The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method.
CVSS 4.0 MEDIUM 6.0· Adjacent network · No auth · No interaction · EPSS 0.00117 · Published 2024-09-26 · No fix listed CWE-521
Priority LOW 25
The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms.
CVSS 4.0 MEDIUM 6.0· Adjacent network · No auth · No interaction · EPSS 0.00085 · Published 2024-09-26 · No fix listed CWE-353
Priority LOW 23
The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages.
CVSS 4.0 MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.00135 · Published 2024-09-26 · No fix listed CWE-204
Priority LOW 23
The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message.
CVSS 4.0 MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.00131 · Published 2024-09-26 · No fix listed CWE-201
Priority LOW 22
In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD).
CVSS 4.0 MEDIUM 5.1· Physical · No auth · No interaction · EPSS 0.00138 · Published 2024-09-26 · No fix listed CWE-922
Priority LOW 11
The goTenna Pro App does not encrypt callsigns in messages.
CVSS 4.0 LOW 2.3· Adjacent network · No auth · No interaction · EPSS 0.00095 · Published 2024-09-26 · No fix listed CWE-319
Open these records in search → All records by CVSS severity
0 7 19 2 0
THREATIST.IORead the docs