Security Vulnerabilities - CVEs Published In September 2024
The goTenna Pro ATAK Plugin does not use SecureRandom when generating
passwords for sharing cryptographic keys. The random function in use
makes it easier for attackers to brute force this password if the
broadcasted encryption key is captured over RF. This only applies to the
optional broadcast of an encryption key, so it is advised to share the
key with local QR code for higher security operations.
CVSS Score
6.5
EPSS Score
0.0
Published
2024-09-26
In the goTenna Pro ATAK Plugin there is a vulnerability that makes it
possible to inject any custom message with any GID and Callsign using a
software defined radio in existing goTenna mesh networks. This
vulnerability can be exploited if the device is being used in an
unencrypted environment or if the cryptography has already been
compromised. It is advised to use encryption shared with local QR code
for higher security operations.
CVSS Score
6.5
EPSS Score
0.0
Published
2024-09-26
The goTenna Pro ATAK Plugin encryption key name is always sent
unencrypted when the key is sent over RF through a broadcast message. It
is advised to share the encryption key via local QR for higher security
operations.
CVSS Score
4.3
EPSS Score
0.0
Published
2024-09-26
The goTenna Pro ATAK Plugin uses AES CTR type encryption for short,
encrypted messages without any additional integrity checking mechanisms.
This leaves messages malleable to an attacker that can access the
message. It is advised to continue to use encryption in the plugin and
update to the current release for enhanced encryption protocols.
CVSS Score
5.3
EPSS Score
0.0
Published
2024-09-26
In the goTenna Pro ATAK Plugin application, the encryption keys are
stored along with a static IV on the device. This allows for complete
decryption of keys stored on the device. This allows an attacker to
decrypt all encrypted broadcast communications based on broadcast keys
stored on the device.
CVSS Score
4.3
EPSS Score
0.0
Published
2024-09-26
Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability leading to code execution.
CVSS Score
7.1
EPSS Score
0.002
Published
2024-09-26
The goTenna Pro ATAK Plugin does not inject extra characters into
broadcasted frames to obfuscate the length of messages. This makes it
possible to tell the length of the payload regardless of the encryption
used.
CVSS Score
4.3
EPSS Score
0.0
Published
2024-09-26
Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x,10.5.3.x, contains an Uncontrolled Resource Consumption vulnerability. A remote unauthenticated host could potentially exploit this vulnerability leading to a denial of service.
CVSS Score
7.5
EPSS Score
0.002
Published
2024-09-26
An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a crafted request.
CVSS Score
7.5
EPSS Score
0.001
Published
2024-09-26
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'preview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the content of private, password protected, pending, and draft posts and pages.
CVSS Score
4.3
EPSS Score
0.001
Published
2024-09-26