ETSI vulnerabilities
We track 3 vulnerabilities in ETSI products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2023.
Latest ETSI vulnerabilities
- 7.5 High severity
TETRA Standard: Improper Validation of Integrity Check Value
Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion.
- 7.5 High severity
TETRA Standard: Improper Restriction of Excessive Authentication Attempts
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.
- 8.1 High severity
TETRA Standard: Authorization Bypass Through User-Controlled Key
Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active