#VU97770 Insecure Storage of Sensitive Information in goTenna Pro App for iOS and goTenna Pro App for Android - CVE-2024-47122

Vulnerability identifier: #VU97770

Vulnerability risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47122

CWE-ID: CWE-922

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
goTenna Pro App for iOS
Mobile applications / Apps for mobile phones
goTenna Pro App for Android
Mobile applications / Apps for mobile phones

Vendor: goTenna

Description

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to the encryption keys are stored along with a static IV on the device. An attacker with physical access can decrypt all encrypted communications that include P2P, Group, and broadcast messages that use these keys.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

goTenna Pro App for iOS: 1.6.1

goTenna Pro App for Android: 1.6.1

---

External links
http://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.