CVE-2024-43694

Summary

CVE-2024-43694 identifies a vulnerability in the goTenna Pro ATAK Plugin application, where encryption keys are stored alongside a static initialization vector (IV) on the device. This design flaw allows attackers to decrypt all encrypted broadcast communications that use the stored keys, posing a significant risk to confidentiality. Affected products include various models under identifiers such as y-MdLt, y-LgJT, and others. To remediate this vulnerability, organizations should update their goTenna Pro ATAK Plugin to mitigate exposure risks. The vulnerability has a medium severity rating, with an exploitability score of 0.7 and requires low privileges for exploitation, emphasizing the need for physical security measures.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.