CVE-2024-45374

Summary

CVE-2024-45374 identifies a vulnerability in the goTenna Pro ATAK Plugin application, where encryption keys are stored alongside a static Initialization Vector (IV) on the device, allowing attackers to decrypt all encrypted broadcast communications. Affected products include multiple models such as y-MdLt, y-LgJT, and others in the goTenna Pro series. The vulnerability poses a high confidentiality impact, with an exploitability score of 1.6 and a base severity rating of medium. To remediate this issue, organizations should ensure that encryption keys are managed securely and not stored in an easily accessible manner alongside static IVs. Failure to address this vulnerability could lead to unauthorized access to sensitive communications within an organization’s network.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.