CVE-2024-43814
📋 TL;DR
The goTenna Pro ATAK Plugin's default settings broadcast user location data every 60 seconds without encryption when the plugin is active. This vulnerability allows unauthorized parties to track users' real-time positions. Affected users are military, emergency responders, and other personnel using goTenna Pro with ATAK in operational environments.
💻 Affected Systems
- goTenna Pro ATAK Plugin
📦 What is this software?
Gotenna by Gotenna
⚠️ Risk & Real-World Impact
Worst Case
Adversaries intercept unencrypted location data to track and target personnel in combat or emergency situations, potentially leading to physical harm or mission compromise.
Likely Case
Unauthorized surveillance of personnel movements, revealing operational patterns and compromising mission security.
If Mitigated
Minimal risk when encryption is properly enabled and PLI settings are configured appropriately.
🎯 Exploit Status
Exploitation requires RF monitoring equipment within range of goTenna transmissions. No authentication needed to intercept broadcasts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest plugin version (specific version not specified in advisory)
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
Restart Required: Yes
Instructions:
1. Update goTenna Pro ATAK Plugin to latest version
2. Restart ATAK application
3. Verify encryption is enabled before missions
🔧 Temporary Workarounds
Manual Encryption Enablement
allManually enable encryption in plugin settings before starting any mission
No CLI commands - GUI configuration only
PLI Broadcast Disablement
allDisable automatic PLI broadcasts or increase broadcast interval
No CLI commands - GUI configuration only
🧯 If You Can't Patch
- Always enable encryption before activating plugin for missions
- Configure PLI broadcast to minimum necessary frequency or disable entirely
🔍 How to Verify
Check if Vulnerable:
Check if plugin is using default PLI settings (60-second broadcasts) without encryption enabledCheck Version:
Check within ATAK app: Settings → Plugin Manager → goTenna Pro PluginVerify Fix Applied:
Verify plugin version is updated and encryption is active before mission start📡 Detection & Monitoring
Log Indicators:
- Unencrypted PLI transmissions in goTenna logs
- Plugin activation without encryption enablement
Network Indicators:
- RF monitoring detecting unencrypted position broadcasts on goTenna frequencies
SIEM Query:
Not applicable - primarily RF-based detection rather than network logs