Описание
The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.
Ссылки
- Third Party AdvisoryUS Government Resource
Уязвимые конфигурации
Конфигурация 1Версия до 1.6.1 (включая)Версия до 2.0.3 (исключая)
Одно из
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:iphone_os:*:*
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:android:*:*
EPSS
Процентиль: 19%
0.0006
Низкий
6.5 Medium
CVSS3
8.8 High
CVSS3
Дефекты
CWE-338
CWE-338
Связанные уязвимости
CVSS3: 8.8
github
больше 1 года назад
The goTenna Pro series does not use SecureRandom when generating its cryptographic keys. The random function in use is not suitable for cryptographic use.
EPSS
Процентиль: 19%
0.0006
Низкий
6.5 Medium
CVSS3
8.8 High
CVSS3
Дефекты
CWE-338
CWE-338