Read the docs
TI-2024-31501 Aliases CVE-2024-47128GHSA-g8xq-w7g6-jc3v

Insertion of Sensitive Information Into Sent Data in goTenna Pro

Priority LOW 23CWE-201Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00131 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
goTennaProup to 1.61—No fix listedCNA
  • Pro VendorgoTenna Affected up to 1.61 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:iphone_os:*:*up to 1.6.1VulnerablegoTenna
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:android:*:*before 2.0.3VulnerablegoTenna
  • cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:iphone_os:*:* Versions up to 1.6.1 Vulnerable ·goTenna
  • cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:android:*:* Versions before 2.0.3 Vulnerable ·goTenna

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47128
  2. 2026-10-03 Alias added: GHSA-g8xq-w7g6-jc3v

References

Advisory 1

  • TI-2024-31503 Missing Authentication for Critical Function in goTenna Pro CVSS 4.0HIGH 8.7
  • TI-2024-31498 Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro CVSS 4.0HIGH 7.6
  • TI-2024-31499 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro CVSS 4.0HIGH 7.1
  • TI-2024-31500 Weak Authentication in goTenna Pro CVSS 4.0MEDIUM 6.0
  • TI-2024-31494 Weak Passwords Requirements in goTenna Pro CVSS 4.0MEDIUM 6.0
  • TI-2024-31496 Missing Support for Integrity Check in goTenna Pro CVSS 4.0MEDIUM 6.0
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences