Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-45838

goTenna Pro ATAK Plugin Cleartext Transmission of Sensitive Information

Low2.3EPSS 0.09%
Published
Updated
Reserved
Assigned by
icscert

Description

The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous versions of the plugin. Update to current plugin version which uses AES-256 encryption for callsigns in encrypted operation

Scores

CVSS scores of CVE-2024-45838, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)4.0Low2.3CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
icscertCNA (assigner)3.1Medium4.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Modified4.0Low2.3CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.09% · top 100% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.3.

Weakness

Affected products

What to do

Solution: goTenna recommends that users mitigate these vulnerabilities by performing the following updates: * ATAK Plugin: v2.0.7 or greater

Workaround: goTenna recommends that users follow these mitigations: General Mitigations for All Users/Clients * Use Discreet Callsigns and Key Names: Choose callsigns and key names that do not disclose sensitive information, such as your location, team size, or team name. Avoid using any identifiers that could inadvertently reveal your location or the composition of your team. * Secure End-User Devices: Implement strong security measures on all end-user devices, including the use of encryption and ensuring regular software updates. * Follow Key Rotation Best Practices: Regularly rotate encryption keys according to industry best practices to maintain ongoing security. Pro-Specific Mitigations * Share Encryption Keys via QR Code: Utilize QR codes, similar to ATAK, for the secure exchange of encryption keys. * Secure Broadcasting: When broadcasting, ensure you are in a secured area and transmit the key at a reduced power of 0.5 Watts to limit exposure. * Leverage Layered Encryption: Implement layered encryption keys to securely manage communications, whether interacting with individuals or teams. If you have any questions please contact best practices https://support.gotennapro.com/s/article/Secure-Operating .

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-45838 badge
[![CVE-2024-45838](https://trackcve.app/badge/CVE-2024-45838.svg)](https://trackcve.app/cve/CVE-2024-45838)

Record last updated .