How severe is CVE-2024-47126?

CVE-2024-47126 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2024-47126 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-47126?

CVE-2024-47126 primarily affects Gotenna Gotenna Pro. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-47126?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-47126 have an EU (EUVD) identifier?

Yes. CVE-2024-47126 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-42278.

When was CVE-2024-47126 published?

CVE-2024-47126 was published on 2024-09-26 and last updated on 2026-06-17.

CVE-2024-47126

CVE-2024-47126 is a medium-severity vulnerability in Gotenna Gotenna Pro with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-338.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 7.1
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-42278
Weakness: CWE-338
Affected product: Gotenna Gotenna Pro
Published: 2024-09-26
Last modified: 2026-06-17

Description

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.

Frequently asked questions

What is CVE-2024-47126?: The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations.
How severe is CVE-2024-47126?: CVE-2024-47126 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2024-47126 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-47126?: CVE-2024-47126 primarily affects Gotenna Gotenna Pro. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-47126?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-47126 have an EU (EUVD) identifier?: Yes. CVE-2024-47126 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-42278.
When was CVE-2024-47126 published?: CVE-2024-47126 was published on 2024-09-26 and last updated on 2026-06-17.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04

Affected products (2)

cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:iphone_os:*:*
cpe:2.3:a:gotenna:gotenna_pro:*:*:*:*:*:android:*:*

More vulnerabilities in Gotenna Gotenna Pro

CVE-2024-47130 — High (CVSS 8.8): The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group…
CVE-2024-47125 — High (CVSS 8.1): The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages.…
CVE-2024-47127 — Medium (CVSS 6.5): In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and…
CVE-2024-47123 — Medium (CVSS 5.3): The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity…
CVE-2024-47121 — Medium (CVSS 5.3): The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted…
CVE-2024-47129 — Medium (CVSS 4.3): The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This…

All CVEs affecting Gotenna Gotenna Pro →

Other CWE-338 vulnerabilities

CVE-2026-56141 — Critical (CVSS 9.8): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account…
CVE-2026-3256 — Critical (CVSS 9.8): HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults…
CVE-2025-15604 — Critical (CVSS 9.8): Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions…
CVE-2025-40926 — Critical (CVSS 9.8): Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session…
CVE-2026-2439 — Critical (CVSS 9.8): Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id…
CVE-2025-15578 — Critical (CVSS 9.8): Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the…

Browse all CWE-338 vulnerabilities →