Priority LOW 39
The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages.
CVSS 4.0HIGH 8.7· Adjacent network · No auth · No interaction · EPSS 0.00216 · Published 2024-09-26 · No fix listed CWE-306
Priority LOW 23
The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages.
CVSS 4.0MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.00135 · Published 2024-09-26 · No fix listed CWE-204
Priority LOW 23
The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message.
CVSS 4.0MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.00131 · Published 2024-09-26 · No fix listed CWE-201
Priority LOW 26
In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks.
CVSS 4.0MEDIUM 6.0· Adjacent network · No auth · No interaction · EPSS 0.00114 · Published 2024-09-26 · No fix listed CWE-1390
Priority LOW 33
The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys.
CVSS 4.0HIGH 7.1· Adjacent network · No auth · No interaction · EPSS 0.00238 · Published 2024-09-26 · No fix listed CWE-338
Priority LOW 34
The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages.
CVSS 4.0HIGH 7.6· Adjacent network · No auth · No interaction · EPSS 0.00142 · Published 2024-09-26 · No fix listed CWE-923
Priority LOW 11
The goTenna Pro App does not encrypt callsigns in messages.
CVSS 4.0LOW 2.3· Adjacent network · No auth · No interaction · EPSS 0.00095 · Published 2024-09-26 · No fix listed CWE-319
Priority LOW 25
The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms.
CVSS 4.0MEDIUM 6.0· Adjacent network · No auth · No interaction · EPSS 0.00085 · Published 2024-09-26 · No fix listed CWE-353
Priority LOW 22
In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD).
CVSS 4.0MEDIUM 5.1· Physical · No auth · No interaction · EPSS 0.00138 · Published 2024-09-26 · No fix listed CWE-922
Priority LOW 26
The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method.
CVSS 4.0MEDIUM 6.0· Adjacent network · No auth · No interaction · EPSS 0.00117 · Published 2024-09-26 · No fix listed CWE-521
THREATIST.IORead the docs