PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-47125 goTenna CVE debrief

goTenna Pro App versions 1.6.1 and earlier fail to authenticate public keys, enabling unauthenticated attackers to manipulate messages in transit. The vulnerability stems from insufficient cryptographic verification, allowing adversaries within radio range to inject or alter communications without possessing valid credentials. CISA published this advisory on September 26, 2024, with an update on October 17, 2024, refining vulnerability details and mitigation guidance. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact with adjacent network access required. goTenna has released patched versions 2.0.3 for both Android and iOS platforms, which implement enhanced encryption protocols addressing the authentication gap.

Vendor
goTenna
Product
Pro
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-09-26
Original CVE updated
2024-10-17
Advisory published
2024-09-26
Advisory updated
2024-10-17

Who should care

Organizations using goTenna Pro X and Pro X2 devices for tactical, emergency, or off-grid communications, including public safety agencies, military units, disaster response teams, and private security operations relying on authenticated message integrity.

Technical summary

The goTenna Pro App's failure to validate public keys creates a cryptographic authentication bypass. An attacker within radio transmission range can exploit this to forge or modify messages without authentication, compromising message integrity and confidentiality. The attack requires adjacent network access (AV:A) but no privileges or user interaction, with low attack complexity. Remediation involves updating to version 2.0.3, which implements proper public key authentication within enhanced encryption protocols.

Defensive priority

HIGH

Recommended defensive actions

  • Update goTenna Pro App to version 2.0.3 or later on Android and iOS devices
  • Use discreet callsigns and key names that do not reveal location, team size, or operational details
  • Implement strong endpoint security measures including device encryption and regular software updates
  • Rotate encryption keys according to industry best practices
  • Exchange encryption keys via QR code rather than broadcast transmission
  • When broadcasting keys is necessary, operate from secured areas at reduced 0.5 Watt power
  • Apply layered encryption for communications with individuals and teams
  • Contact goTenna Pro support at [email protected] for technical assistance

Evidence notes

The source advisory confirms affected versions through CSAFPID-0001 (goTenna Pro App ≤1.6.1) and specifies remediation versions 2.0.3 or greater for both platforms.

Official resources

CISA published ICSA-24-270-04 on September 26, 2024, with Update A released October 17, 2024.