TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HThetrackr Trackr Bravo
HWThetrackrwszystkie wersjeThetrackr Trackr Bravo Firmware
OSThetrackr< 2.2.5< 5.1.6
Related vulnerabilities
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in ...
Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sendin...
TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventual...
The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC addres...