CVE-2024-47126
MEDIUMDescription
The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.
Is your site exposed to CVE-2024-47126?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| gotenna | gotenna_pro |
| gotenna | gotenna_pro |
References
Other References
Frequently Asked Questions
What is CVE-2024-47126? +
How severe is CVE-2024-47126? +
What products are affected by CVE-2024-47126? +
How do I check if I'm vulnerable to CVE-2024-47126? +
Related Vulnerabilities
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor …
Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt …
The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to …
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform …
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using …
Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.