Keystream recovery for arbitrary frames in TETRA
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of these counters in a mobile station, provoking keystream re-use. By sending crafted messages to the MS and analyzing MS responses, keystream for arbitrary frames can be recovered.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ETSI | TETRA Standard | all and later | — | No fix listed | CNA |
- TETRA Standard VendorETSI Affected all and later Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:midnightblue:tetra\:burst:-:*:*:*:*:*:*:* | burst | Vulnerable | Midnightblue |
- cpe:2.3:a:midnightblue:tetra\:burst:-:*:*:*:*:*:*:* Versions burst Vulnerable ·Midnightblue
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24401
- 2026-10-03 Alias added: GHSA-c3v3-8wvp-5mg4
References
Advisory 1
More ETSI vulnerabilities
- TI-2022-08278 Intentionally weakened effective strength in TETRA TEA1 CVSS 3.1HIGH 8.8
- TI-2022-08276 DCK pinning attack in TETRA CVSS 3.1HIGH 7.5
- TI-2022-08280 Ciphertext Malleability in TETRA CVSS 3.1HIGH 7.5
- TI-2019-06649 The ETSI Enterprise Transport Security (ETS, formerly known as eTLS) protocol does not… CVSS 3.0MEDIUM 5.9
- TI-2022-08279 De-anonymization attack in TETRA CVSS 3.1MEDIUM 4.3
Sources
- CVE-2022-24401 · CVE Program
- CVE-2022-24401 · NVD
- FIRST EPSS
- GHSA-c3v3-8wvp-5mg4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences