CVE-2024-47126— Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro
Quick assessment
Affected
goTenna Pro
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
goTenna Pro是goTenna公司的一系列可为离网通信和态势感知创建网络的设备。 goTenna Pro存在安全漏洞，该漏洞源于在生成其加密密钥时不使用强随机数。
Possible ATT&CK Techniques 1 AI
T1592 · Gather Victim Host Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-47126
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro
Source: CVE Program / CVE List V5
Vulnerability Description
The goTenna Pro App does not use SecureRandom when generating passwords
for sharing cryptographic keys. The random function in use makes it
easier for attackers to brute force this password if the broadcasted
encryption key is captured over RF. This only applies to the optional
broadcast of an encryption key, so it is advised to share the key with
local QR code for higher security operations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用具有密码学弱点缺陷的PRNG
Source: CVE Program / CVE List V5
Vulnerability Title
goTenna Pro 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
goTenna Pro是goTenna公司的一系列可为离网通信和态势感知创建网络的设备。 goTenna Pro存在安全漏洞，该漏洞源于在生成其加密密钥时不使用强随机数。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-47126
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-47126
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-47126 (1)
-
goTenna Pro X and Pro X2 (Update A) | CISA government-resource
Same Patch Batch · goTenna · 2024-09-26 · 19 CVEs total
| CVE-2024-47130 | 8.8 HIGH | Missing Authentication for Critical Function in goTenna Pro |
| CVE-2024-47125 | 8.1 HIGH | Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro |
| CVE-2024-45723 | 6.5 MEDIUM | goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator |
| CVE-2024-47127 | 6.5 MEDIUM | Weak Authentication in goTenna Pro |
| CVE-2024-41722 | 6.5 MEDIUM | goTenna Pro ATAK Plugin Weak Authentication |
| CVE-2024-45374 | 5.3 MEDIUM | goTenna Pro ATAK Plugin Weak Password Requirements |
| CVE-2024-47123 | 5.3 MEDIUM | Missing Support for Integrity Check in goTenna Pro |
| CVE-2024-47121 | 5.3 MEDIUM | Weak Passwords Requirements in goTenna Pro |
| CVE-2024-43108 | 5.3 MEDIUM | goTenna Pro ATAK Plugin Missing Support for Integrity Check |
| CVE-2024-41715 | 4.3 MEDIUM | goTenna Pro ATAK Plugin Observable Response Discrepancy |
| CVE-2024-41931 | 4.3 MEDIUM | goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data |
| CVE-2024-47122 | 4.3 MEDIUM | Insecure Storage of Sensitive Information in goTenna Pro |
| CVE-2024-43814 | 4.3 MEDIUM | goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data |
| CVE-2024-47129 | 4.3 MEDIUM | Observable Response Discrepancy in goTenna Pro |
| CVE-2024-43694 | 4.3 MEDIUM | goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information |
| CVE-2024-47128 | 4.3 MEDIUM | Insertion of Sensitive Information Into Sent Data in goTenna Pro |
| CVE-2024-45838 | 4.3 MEDIUM | goTenna Pro ATAK Plugin Cleartext Transmission of Sensitive Information |
| CVE-2024-47124 | 4.3 MEDIUM | Cleartext Transmission of Sensitive Information in goTenna Pro |
IV. Related Vulnerabilities
Same product: Pro
-
CVE-2025-5119
Emlog Pro api_controller.php sql injection -
CVE-2024-10183
Arbitrary File Write Vulnerability in Jamf Remote Assist Lea -
CVE-2024-47130
Missing Authentication for Critical Function in goTenna Pro -
CVE-2024-47129
Observable Response Discrepancy in goTenna Pro -
CVE-2024-47128
Insertion of Sensitive Information Into Sent Data in goTenna
Same vendor: goTenna
-
CVE-2024-43814
goTenna Pro ATAK Plugin Insertion of Sensitive Information I -
CVE-2024-41715
goTenna Pro ATAK Plugin Observable Response Discrepancy -
CVE-2024-41931
goTenna Pro ATAK Plugin Insertion of Sensitive Information I -
CVE-2024-41722
goTenna Pro ATAK Plugin Weak Authentication -
CVE-2024-45723
goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo
Same weakness: CWE-338
-
CVE-2026-74887
openssl_encrypt before 1.4.0 Insecure Random Import in PQC M -
CVE-2026-74874
openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel S -
CVE-2026-73567
sm-crypto: Predictable SM2 key generation in Node.js: defaul -
CVE-2026-18611
Data-science-pipelines-operator: dspo: cryptographically wea -
CVE-2026-9205
Langflow is affected by weaknesses in secret handling and se
V. Comments for CVE-2024-47126
No comments yet