MEDIUM🇬🇧 English

CVE-2016-6540

CVSS 6.5v3.0pub. 2018-07-06upd. 2024-11-21

Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

oryginał EN
CVSS Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Thetrackr Trackr Bravo

    HW
    Thetrackr
    wszystkie wersje

  • Thetrackr Trackr Bravo Firmware

    OS
    Thetrackr
    < 2.2.5< 5.1.6
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2016-6538HIGH8.8ten sam produkt

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in ...

CVE-2016-6541HIGH8.8ten sam produkt

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to wr...

CVE-2020-13425HIGH7.1ten sam vendor

TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventual...

CVE-2016-6539LOW3.5ten sam vendor

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC addres...