CVE-2024-47129
📋 TL;DR
The goTenna Pro App fails to pad broadcasted frames with extra characters, allowing attackers to determine the length of encrypted messages. This information leakage vulnerability affects users of the goTenna Pro App who rely on its encrypted communication capabilities.
💻 Affected Systems
- goTenna Pro App
📦 What is this software?
Gotenna Pro by Gotenna
Gotenna Pro by Gotenna
⚠️ Risk & Real-World Impact
Worst Case
Attackers could analyze message length patterns to infer sensitive information about communication content, potentially compromising operational security in critical scenarios.
Likely Case
Passive attackers monitoring communications could gain insights into message types and patterns, reducing the effectiveness of encryption.
If Mitigated
With proper network segmentation and monitoring, the risk is limited to information leakage rather than direct system compromise.
🎯 Exploit Status
Exploitation requires physical proximity to intercept radio communications but doesn't require authentication to the app.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest app store updates
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
Restart Required: Yes
Instructions:
1. Open Google Play Store or Apple App Store
2. Search for 'goTenna Pro'
3. Update to latest version
4. Restart the app
🔧 Temporary Workarounds
Limit sensitive communications
allAvoid transmitting highly sensitive information through the app until patched
Implement message padding manually
allAdd random-length padding to messages before transmission
🧯 If You Can't Patch
- Use alternative secure communication methods for sensitive data
- Implement physical security controls to prevent unauthorized proximity to communications
🔍 How to Verify
Check if Vulnerable:
Check app version in settings and compare against latest version in app storeCheck Version:
Open goTenna Pro App → Settings → About → Check version numberVerify Fix Applied:
Confirm app is updated to latest version and test with packet analysis tools📡 Detection & Monitoring
Log Indicators:
- Unusual patterns in message transmission logs
- Consistent message length patterns despite encryption
Network Indicators:
- Radio frequency monitoring showing consistent packet sizes
- Pattern analysis of encrypted traffic
SIEM Query:
Not applicable - primarily requires RF monitoring rather than traditional network SIEM