OTPulse

goTenna Pro ATAK Plugin (Update A)

MonitorCVSS 6.5ICS-CERT ICSA-24-270-05Sep 26, 2024
Mitsubishi Electric
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

The goTenna Pro ATAK Plugin versions 1.9.12 and earlier contain multiple weaknesses in encryption key handling and storage that could allow an attacker on the local network to read communications or extract encryption keys. The vulnerabilities stem from insecure storage of encryption keys, weak key generation, insufficient obfuscation, and transmission of sensitive data in plaintext over the network. These issues compromise the confidentiality and integrity of tactical communications between team members.

What this means
What could happen
An attacker with local network access to a device running the goTenna Pro ATAK Plugin could intercept or eavesdrop on communications between team members, potentially exposing sensitive operational information, locations, or tactical details.
Who's at risk
Field teams and tactical units using goTenna Pro devices with the ATAK (Android Tactical Assault Kit) Plugin for tactical communications should prioritize patching. This affects military, emergency response, law enforcement, and any organization relying on goTenna for secure communications where team location or operational details must remain confidential.
How it could be exploited
An attacker must be on the same local network segment as a device running the vulnerable ATAK Plugin. They can then capture network traffic to read communication content or extract encryption keys that are transmitted insecurely, allowing them to decrypt messages or impersonate users in the network.
Prerequisites
  • Local network access to the same subnet as the goTenna Pro ATAK Plugin device
  • No credentials or authentication required
  • Ability to capture or intercept network traffic on the local network
encryption key storage and transmission defectslocal network exposure requiredlow authentication requirementsaffects confidentiality of communicationsno active exploitation reported
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (1)
ProductAffected VersionsFix Status
goTenna Pro ATAK Plugin: <=1.9.12≤ 1.9.122.0.7
Remediation & Mitigation
0/6
Do now
0/3
WORKAROUNDUse QR codes instead of manual entry to exchange encryption keys between goTenna Pro devices
WORKAROUNDRotate encryption keys regularly according to your organization's key management policy
WORKAROUNDWhen broadcasting, transmit at reduced power (0.5 Watts) and only from secured locations to limit network exposure
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate goTenna Pro ATAK Plugin to version 2.0.7 or later
Long-term hardening
0/2
HARDENINGIsolate goTenna Pro devices and their network segment from business networks using a firewall or VLAN
HARDENINGUse discreet callsigns and key names that do not reveal team composition, location, or sensitive identifiers
View full CISA ICS-CERT advisory
API: /api/v1/advisories/29cf36f6-fd9a-4e08-8042-cdf001249150

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

goTenna Pro ATAK Plugin (Update A) | CVSS 6.5 - OTPulse