PT-2018-4941 · Trackr+1 · Bravo Mobile Application+1

Adam Compton + 1 · Publicado 2018-07-06 · Atualizado 2019-10-09 · CVE-2016-6540

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Correção

Missing Authentication

Information Disclosure

Enumeração de Fraquezas

CWE-306

CWE-200

Identificadores relacionados

CVE-2016-6540

Produtos afetados

Bravo Mobile Application

Trackr Bravo Firmware

Referências · 6

• https://kb.cert.org/vuls/id/617567 · Nota
• https://kb.cert.org/vuls/id/TNOY-AF3KCZ · Nota
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities · Nota
• https://osv.dev/vulnerability/CVE-2016-6540 · Aviso do Fabricante
• http://securityfocus.com/bid/93874 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6540 · Nota de Segurança