CVE-2024-41722
📋 TL;DR
The goTenna Pro ATAK Plugin vulnerability allows attackers to inject forged messages with arbitrary group IDs and callsigns into goTenna mesh networks using software-defined radio. This affects users of goTenna Pro devices in ATAK environments, particularly when operating without encryption or with compromised cryptography.
💻 Affected Systems
- goTenna Pro ATAK Plugin
📦 What is this software?
Gotenna by Gotenna
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of tactical communications with forged orders, false location data, or malicious commands leading to operational failure or physical harm.
Likely Case
Disruption of legitimate communications, injection of false information, and potential confusion among tactical teams.
If Mitigated
Limited impact if strong encryption with QR code authentication is properly implemented and maintained.
🎯 Exploit Status
Requires software-defined radio equipment and proximity to target mesh network. No authentication needed for message injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
Restart Required: Yes
Instructions:
1. Update goTenna Pro ATAK Plugin to latest version
2. Ensure encryption is enabled with QR code authentication
3. Restart ATAK application
🔧 Temporary Workarounds
Enable Strong Encryption
allAlways use encryption with QR code authentication for all operations
Network Segmentation
allPhysically separate critical mesh networks from general use networks
🧯 If You Can't Patch
- Always operate with encryption and QR code authentication enabled
- Implement physical security measures to prevent unauthorized radio access to operational areas
🔍 How to Verify
Check if Vulnerable:
Check goTenna Pro ATAK Plugin version against vendor advisoryCheck Version:
Check within ATAK app settings or device application managerVerify Fix Applied:
Confirm plugin is updated to patched version and encryption with QR code is active📡 Detection & Monitoring
Log Indicators:
- Unexpected GID/callsign combinations
- Messages from unknown sources
- Encryption status changes
Network Indicators:
- Radio frequency anomalies in operational bands
- Unexpected message injection patterns
SIEM Query:
Not applicable for tactical radio networks