CVE-2016-6538

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.05%

Published

Jul 6, 2018

Modified

Nov 20, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Weaknesses (CWE)

CWE-313CWE-200CWE-255

Affected Products (3)

thetrackr · trackr_bravo_firmware (up to 2.2.5)vulnerable

thetrackr · trackr_bravo_firmware (up to 5.1.6)vulnerable

thetrackr · trackr_bravo

References (8)

http://www.securityfocus.com/bid/93874

Third Party AdvisoryVDB Entry

https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/

ExploitThird Party Advisory

https://www.kb.cert.org/vuls/id/617567