CVE-2022-24403mediumCWE-327

CVE-2022-24403: medium-severity vulnerability in ETSI TETRA Standard

De-anonymization attack in TETRA

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.1%
exploitation probability
0.1%top 98% of all CVEs
observed exploitation
nono source reports it
In short

TETRA's identity encryption method uses a weak 64-bit key that can be recovered from just three pairs of encrypted and unencrypted identities, allowing attackers to impersonate users or decrypt private communications.

Technical detail

The TA61 identity encryption function derives its key material from a single 64-bit SCK or CCK value, enabling key recovery through meet-in-the-middle attacks with minimal known plaintext-ciphertext pairs. An adversary with access to three encrypted/unencrypted identity pairs can reconstruct the encryption key and subsequently encrypt or decrypt arbitrary identities, compromising confidentiality and user anonymity in TETRA Class 2 and 3 networks.

Summary generated and translated by AI from the official description.
The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The structure of TA61 allows for efficient recovery of this 64-bit value, allowing an adversary to encrypt or decrypt arbitrary identities given only three known encrypted/unencrypted identity pairs.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:A/MAC:L/MPR:N/MUI:N/MS:U/MC:L/MI:N/MA:N
Affected products
ETSI · TETRA Standard
Related CVEs — ETSI TETRA Standard

In the same product, most dangerous first.

CVE-2022-24402HIGHIntentionally weakened effective strength in TETRA TEA1EPSS 0.6%CVE-2022-24401HIGHKeystream recovery for arbitrary frames in TETRAEPSS 0.3%CVE-2022-24400HIGHDCK pinning attack in TETRAEPSS 0.3%CVE-2022-24404MEDIUMCiphertext Malleability in TETRAEPSS 0.3%
References
https://tetraburst.com/