CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

TETRA Radio Encryption Vulnerabilities Exposed at Black Hat USA 2025

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

Researchers from Midnight Blue presented new vulnerabilities in the Terrestrial Trunked Radio (TETRA) communications protocol at Black Hat USA 2025. The flaws, collectively named 2TETRA:2BURST, affect the protocol's end-to-end encryption (E2EE) mechanism, exposing it to replay and brute-force attacks. TETRA is widely used by law enforcement, military, and critical infrastructure operators. The vulnerabilities allow for packet injection, keystream recovery, and decryption of encrypted traffic. The issues include replay attacks on voice streams, brute-force vulnerabilities in the AES-128 implementation, replay of encrypted messages, key recovery attacks, and arbitrary message injection. ETSI's previous fix for a related vulnerability is ineffective. The impact varies by network configuration, with data-carrying networks being particularly susceptible. No evidence of exploitation in the wild has been reported, and patches are pending. Additionally, three vulnerabilities in the Sepura SC20 series of mobile TETRA radios were disclosed, allowing unauthorized code execution and key material exfiltration.

Timeline

  1. 11.08.2025 19:32 📰 1 articles · ⏱ 1mo ago

    2TETRA:2BURST Vulnerabilities in TETRA Protocol Disclosed at Black Hat USA 2025

    Researchers from Midnight Blue presented new vulnerabilities in the TETRA communications protocol at Black Hat USA 2025. The flaws, named 2TETRA:2BURST, affect the protocol's end-to-end encryption (E2EE) mechanism, exposing it to replay and brute-force attacks. The vulnerabilities include replay attacks on voice streams, brute-force vulnerabilities in the AES-128 implementation, replay of encrypted messages, key recovery attacks, and arbitrary message injection. Additionally, three vulnerabilities in the Sepura SC20 series of mobile TETRA radios were disclosed, allowing unauthorized code execution and key material exfiltration. Patches for these vulnerabilities are expected in the third quarter of 2025.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

Active exploitation of CVE-2025-5086 in DELMIA Apriso

CVE-2025-5086, a critical deserialization flaw in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software, is being actively exploited. The vulnerability, with a CVSS score of 9.0, affects versions from Release 2020 through Release 2025. Exploitation attempts have been observed, targeting the /apriso/WebServices/FlexNetOperationsService.svc/Invoke endpoint with a Base64-encoded payload. The payload decodes to a GZIP-compressed Windows executable that deploys a malicious program designed to spy on user activities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, advising Federal Civilian Executive Branch (FCEB) agencies to apply updates by October 2, 2025. The malware, identified as Trojan.MSIL.Zapchast.gen, captures keyboard input, takes screenshots, and gathers information about active applications. This information is then sent to the attacker via various means, including email, FTP, and HTTP. The exploit involves sending a malicious SOAP request to vulnerable endpoints. The malicious requests were observed originating from the IP 156.244.33[.]162.

Open in new tab

Akira Ransomware Group Exploits SonicWall SSL VPN Flaws

The Akira ransomware group has been actively exploiting SonicWall SSL VPN flaws and misconfigurations to gain initial access to networks. This campaign has seen increased activity since late July 2025, targeting SonicWall devices to facilitate ransomware operations. The group leverages a combination of security vulnerabilities, including a year-old flaw (CVE-2024-40766) and misconfigured LDAP settings, to bypass access controls and infiltrate networks. Organizations are advised to rotate passwords, remove unused accounts, enable multi-factor authentication, and restrict access to the Virtual Office Portal to mitigate risks. The Australian Cyber Security Centre (ACSC) has acknowledged Akira's targeting of SonicWall SSL VPNs and issued alerts about the increased exploitation of CVE-2024-40766.

Open in new tab

Microsoft September 2025 Patch Tuesday fixes 81 vulnerabilities, including two zero-days

Microsoft released updates for 80 vulnerabilities on September 2025 Patch Tuesday. None of these vulnerabilities were zero-days. The updates address eight critical flaws, including five remote code execution vulnerabilities, one information disclosure, and two elevation of privilege vulnerabilities. The vulnerabilities span various categories: 38 elevation of privilege, 2 security feature bypass, 22 remote code execution, 14 information disclosure, 3 denial of service, and 1 spoofing. One zero-day vulnerability was fixed in Windows SMB Server. The updates also include hardening features for SMB Server to mitigate relay attacks, with recommendations for administrators to enable auditing. The patch includes 38 elevation of privilege vulnerabilities, the highest number among all categories. CVE-2025-54918 is an EoP vulnerability in Windows NT LAN Manager (NTLM) marked as critical. CVE-2025-54111 and CVE-2025-54913 are EoP flaws in Windows UI XAML, allowing privilege escalation via phished credentials or malicious Microsoft Store apps. CVE-2025-55232 is an RCE vulnerability in the Microsoft High Performance Compute (HPC) Pack with a CVSS score of 9.8. CVE-2025-54916 is an RCE vulnerability in Windows NTFS that can be triggered by authenticated users. Microsoft's patch update includes recommendations for preparing for the end-of-life of Windows 10 and mandatory multifactor authentication (MFA) for Azure in October 2025.

Open in new tab

Critical SAP S/4HANA Command Injection Vulnerability Exploited

A critical command injection vulnerability in SAP S/4HANA (CVE-2025-42957) is being actively exploited in the wild. The flaw, with a CVSS score of 9.9, allows attackers with low-privileged user access to execute arbitrary ABAP code, bypass authorization checks, and fully compromise the SAP environment. This can lead to data theft, fraud, or ransomware installation. The vulnerability affects both on-premise and Private Cloud editions of SAP S/4HANA, as well as several other SAP products and versions. SecurityBridge Threat Research Labs discovered the vulnerability and reported it to SAP on June 27, 2025. The vendor fixed the vulnerability on August 11, 2025, but several systems have not applied the available security updates and are now being targeted by hackers. Exploitation activity surged dramatically after the patch was released. Organizations are advised to apply patches immediately, monitor logs for suspicious activity, and implement additional security measures.

Open in new tab

WhatsApp Zero-Day Exploited in Targeted Attacks

WhatsApp patched a zero-day vulnerability (CVE-2025-55177) in its messaging apps for Apple iOS and macOS. The flaw allowed unauthorized users to process content from arbitrary URLs on targeted devices. The issue was exploited in conjunction with a recently disclosed Apple flaw (CVE-2025-43300) in targeted zero-day attacks. WhatsApp notified less than 200 users who may have been targeted as part of the spyware campaign. The vulnerability relates to insufficient authorization of linked device synchronization messages. The exploitation involved chaining the WhatsApp flaw with the Apple vulnerability, enabling sophisticated attacks against specific users. The CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and is advising federal agencies to apply mitigations by September 23, 2025.

Open in new tab