CVE-2024-45374
📋 TL;DR
The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via RF broadcast, allowing attackers who capture the broadcast to potentially brute-force the password and decrypt all messages encrypted with that key. This affects users who enable the optional key broadcast feature in goTenna Pro ATAK plugin deployments.
💻 Affected Systems
- goTenna Pro ATAK plugin
📦 What is this software?
Gotenna by Gotenna
⚠️ Risk & Real-World Impact
Worst Case
All encrypted communications using a compromised key become readable, exposing sensitive tactical data and compromising operational security.
Likely Case
Limited exposure of specific encrypted broadcasts if an attacker is within RF range and successfully cracks the weak password.
If Mitigated
No impact if key broadcast feature is disabled and local QR key sharing is used instead.
🎯 Exploit Status
Requires physical proximity to capture RF transmissions and computational resources for password cracking.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in advisory - check vendor updates
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
Restart Required: Yes
Instructions:
1. Update goTenna Pro ATAK plugin to latest version. 2. Restart ATAK application. 3. Verify key broadcast uses stronger encryption if still needed.
🔧 Temporary Workarounds
Disable RF Key Broadcast
allCompletely disable the optional key broadcast feature and use local QR code sharing instead.
Navigate to plugin settings and disable 'Key Broadcast over RF' option
🧯 If You Can't Patch
- Disable the key broadcast feature immediately
- Use only local QR code encryption key sharing methods
🔍 How to Verify
Check if Vulnerable:
Check if key broadcast feature is enabled in goTenna Pro ATAK plugin settingsCheck Version:
Check plugin version in ATAK plugin management interfaceVerify Fix Applied:
Verify plugin is updated to latest version and key broadcast is either disabled or uses enhanced security📡 Detection & Monitoring
Log Indicators:
- Multiple failed decryption attempts
- Unusual key broadcast activity
Network Indicators:
- RF spectrum analysis showing key broadcast patterns
- Unexpected RF monitoring equipment in operational area
SIEM Query:
Not applicable - primarily physical/RF based attack vector