Description
The goTenna Pro ATAK Plugin does not use SecureRandom when generating
passwords for sharing cryptographic keys. The random function in use
makes it easier for attackers to brute force this password if the
broadcasted encryption key is captured over RF. This only applies to the
optional broadcast of an encryption key, so it is advised to share the
key with local QR code for higher security operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| goTenna | Pro ATAK Plugin | ≤ 1.9.12 | — |
Advisories 1
- ICSA-24-270-05 goTenna Pro ATAK Plugin (Update A) CISA ICS & IT advisories · Oct 17, 2024
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05 government-resource