Vulnerability · Published Oct 19, 2023 · Assigned by NCSC-NL
CVE-2022-24402Intentionally weakened effective strength in TETRA TEA1
High 8.8
In plain English
A high-severity security flaw in TETRA Standard from ETSI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 51.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ETSI | TETRA Standard | TEA1 |
Weakness: CWE-334 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:A/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H
References
- TETRA:BURST related