CVE-2022-24402highCWE-334

CVE-2022-24402: high-severity vulnerability in ETSI TETRA Standard

Intentionally weakened effective strength in TETRA TEA1

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.6%
exploitation probability
0.6%top 53% of all CVEs
observed exploitation
nono source reports it
In short

TETRA TEA1 encryption reduces an 80-bit key to just 32 bits during operation, making it vulnerable to brute-force attacks that can crack the encryption in reasonable time.

Technical detail

The TEA1 keystream generator's key register initialization compresses the full 80-bit key material to 32 bits effective entropy for keystream generation, enabling exhaustive search attacks with feasible computational cost. This design weakness significantly reduces the cryptographic strength below the theoretical key size, allowing attackers to recover the keystream through key enumeration.

Summary generated and translated by AI from the official description.
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:A/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H
Affected products
ETSI · TETRA Standard
Related CVEs — ETSI TETRA Standard

In the same product, most dangerous first.

CVE-2022-24401HIGHKeystream recovery for arbitrary frames in TETRAEPSS 0.3%CVE-2022-24400HIGHDCK pinning attack in TETRAEPSS 0.3%CVE-2022-24404MEDIUMCiphertext Malleability in TETRAEPSS 0.3%CVE-2022-24403MEDIUMDe-anonymization attack in TETRAEPSS 0.1%
References
https://tetraburst.com/