{"id":"CVE-2024-43108","aliases":["EUVD-2024-40037","GHSA-pf8r-hfj4-5hrm"],"status":"published","title":"goTenna Pro ATAK Plugin Missing Support for Integrity Check","description":"The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, \nencrypted messages without any additional integrity checking mechanisms.\n This leaves messages malleable to an attacker that can access the \nmessage. It is advised to continue to use encryption in the plugin and \nupdate to the current release for enhanced encryption protocols.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00091,"percentile":0.0045,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345","CWE-353"],"published":"2024-09-26T17:28:10Z","modified":"2026-06-17T07:50:27Z","products":[{"vendor":"gotenna","product":"gotenna"},{"vendor":"gotenna","product":"pro atak plugin"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05","tags":["government-resource","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43108"},{"url":"https://github.com/advisories/GHSA-pf8r-hfj4-5hrm"}],"sources":{"cve":[{"id":"CVE-2024-43108","title":"goTenna Pro ATAK Plugin Missing Support for Integrity Check","description":"The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, \nencrypted messages without any additional integrity checking mechanisms.\n This leaves messages malleable to an attacker that can access the \nmessage. It is advised to continue to use encryption in the plugin and \nupdate to the current release for enhanced encryption protocols.","status":"published","published":"2024-09-26T17:28:10.341Z","modified":"2024-10-17T16:53:16.231Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-353"],"updated_at":"2026-11-02T14:33:58.839967Z"}],"euvd":[{"id":"EUVD-2024-40037","description":"The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, \nencrypted messages without any additional integrity checking mechanisms.\n This leaves messages malleable to an attacker that can access the \nmessage. It is advised to continue to use encryption in the plugin and \nupdate to the current release for enhanced encryption protocols.","status":"published","published":"2024-09-26T17:28:10Z","modified":"2024-10-17T16:53:16Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T00:27:33.799805Z"}],"ghsa":[{"id":"GHSA-pf8r-hfj4-5hrm","title":"The goTenna Pro ATAK Plugin use AES CTR mode for short, encrypted \nmessages without any...","description":"The goTenna Pro ATAK Plugin use AES CTR mode for short, encrypted \nmessages without any additional integrity checking mechanisms. This \nleaves messages malleable to any attacker that can access the message.","status":"published","published":"2024-09-26T18:31:45Z","modified":"2024-10-07T21:34:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-345","CWE-353"],"updated_at":"2026-11-02T14:58:25.780996Z"}],"nvd":[{"id":"CVE-2024-43108","description":"The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, \nencrypted messages without any additional integrity checking mechanisms.\n This leaves messages malleable to an attacker that can access the \nmessage. It is advised to continue to use encryption in the plugin and \nupdate to the current release for enhanced encryption protocols.","status":"published","published":"2024-09-26T18:15:06.713Z","modified":"2026-06-17T07:50:27.1Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-353","CWE-345"],"updated_at":"2026-11-02T14:10:29.044588Z"}]}}