LOW🇵🇱 Wersja polska

CVE-2016-6539

CVSS 3.5v3.0pub. 2018-07-06upd. 2024-11-21

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

CVSS Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

  • Thetrackr Trackr

    HW
    Thetrackr
    wszystkie wersje

  • Thetrackr Trackr Firmware

    OS
    Thetrackr
    < 2.2.5< 5.1.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2020-13425HIGH7.1ten sam produkt

TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventual...

CVE-2016-6538HIGH8.8ten sam vendor

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in ...

CVE-2016-6541HIGH8.8ten sam vendor

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to wr...

CVE-2016-6540MEDIUM6.5ten sam vendor

Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sendin...