Skip to content
OpenAdvisories
Medium · 6.5 CVE-2024-47127 EUVD-2024-42279GHSA-fg6p-6vjg-95r5

Weak Authentication in goTenna Pro

Published Sep 26, 2024 · Updated Oct 17, 2024 · Assigned by icscert

Description

In the goTenna Pro App there is a vulnerability that makes it possible
to inject any custom message with any GID and Callsign using a software
defined radio in existing goTenna mesh networks. This vulnerability can
be exploited if the device is being used in an unencrypted environment
or if the cryptography has already been compromised. It is advised to
share encryption keys via QR scanning for higher security operations and
update your app to the current release for enhanced encryption
protocols.

Affected products

VendorProductAffectedFixed
goTenna Pro ≤ 1.61 —

Advisories 1

References