Vulnerability · Published Dec 5, 2023 · Assigned by NCSC-NL

CVE-2022-24403De-anonymization attack in TETRA

Medium 4.3

In plain English

A medium-severity broken cryptography in TETRA Standard from ETSI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.1%top 97.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The structure of TA61 allows for efficient recovery of this 64-bit value, allowing an adversary to encrypt or decrypt arbitrary identities given only three known encrypted/unencrypted identity pairs.

Affected products (as reported)

Vendor	Product	Versions
ETSI	TETRA Standard	TA61

Weakness: CWE-327 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:A/MAC:L/MPR:N/MUI:N/MS:U/MC:L/MI:N/MA:N

References

TETRA:BURST related