PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-43108 goTenna CVE debrief

goTenna Pro ATAK Plugin versions 1.9.12 and earlier use AES-CTR encryption for short messages without integrity checking mechanisms, leaving ciphertext malleable to attackers with message access. The vulnerability allows integrity compromise (CVSS 5.3 MEDIUM) but does not enable confidentiality breaches or availability impacts. CISA published this advisory on September 26, 2024, with an update on October 17, 2024 revising the vulnerability overview and mitigations. goTenna released ATAK Plugin version 2.0.7 with enhanced encryption protocols to address this weakness.

Vendor
goTenna
Product
Pro ATAK Plugin
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-09-26
Original CVE updated
2024-10-17
Advisory published
2024-09-26
Advisory updated
2024-10-17

Who should care

Organizations using goTenna Pro ATAK Plugin for tactical communications in military, emergency response, law enforcement, or critical infrastructure protection contexts where message integrity is essential for operational safety and decision-making.

Technical summary

The goTenna Pro ATAK Plugin implements AES-CTR mode encryption without message authentication codes (MAC) or authenticated encryption with associated data (AEAD). CTR mode produces a keystream XORed with plaintext; without integrity verification, an attacker with ciphertext access can flip bits in the ciphertext to produce predictable changes in decrypted plaintext. The attack requires adjacent network access (AV:A) and high attack complexity (AC:H) per CVSS 3.1 scoring. The vulnerability affects confidentiality and availability not at all (C:N, A:N) but enables high integrity impact (I:H). Version 2.0.7 introduces enhanced encryption protocols presumed to add authentication. Operational mitigations include key management hygiene, reduced transmission power, and layered encryption architectures.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update goTenna Pro ATAK Plugin to version 2.0.7 or greater to obtain enhanced encryption protocols with integrity protection
  • Use discreet callsigns and key names that do not disclose location, team size, or team composition
  • Implement strong device security measures including encryption and regular software updates on all end-user devices
  • Rotate encryption keys regularly according to industry best practices
  • Exchange encryption keys via QR code rather than over-the-air transmission when possible
  • When broadcasting keys, operate from secured areas at reduced power (0.5 Watts) to limit exposure
  • Implement layered encryption keys for secure individual and team communications
  • Contact [email protected] for technical support questions

Evidence notes

Advisory ICSA-24-270-05 (Update A) from CISA documents the AES-CTR implementation without message authentication codes or authenticated encryption, confirming malleability under attacker access. CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N reflects adjacent network attack vector, high attack complexity, and high integrity impact. Remediation guidance specifies ATAK Plugin v2.0.7 or greater as the fixed version.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-43108 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-43108

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-43108 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-43108

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-270-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.