PT-2018-4945 · Itrack · Itrack Easy

Adam Compton + 1 · Publicado 2018-07-13 · Atualizado 2019-10-09 · CVE-2016-6544

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions iTrack Easy (affected versions not specified)

Description The issue allows modification of getgps data without authentication by utilizing the cmd:setothergps parameter. This can be exploited to alter the GPS data of a lost device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Enumeração de Fraquezas

CWE-306

CWE-287

Identificadores relacionados

CVE-2016-6544

Produtos afetados

Itrack Easy

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-6544 · Nota de Segurança
• http://securityfocus.com/bid/93875 · Nota
• https://kb.cert.org/vuls/id/974055 · Nota
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities · Nota