PT-2018-4941 · Trackr+1 · Bravo Mobile Application+1

Adam Compton + 1 · Published 2018-07-06 · Updated 2019-10-09 · CVE-2016-6540

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Fix

Missing Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-200

Related Identifiers

CVE-2016-6540

Affected Products

Bravo Mobile Application

Trackr Bravo Firmware

References · 6

• https://osv.dev/vulnerability/CVE-2016-6540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6540 · Security Note
• https://kb.cert.org/vuls/id/617567 · Note
• https://kb.cert.org/vuls/id/TNOY-AF3KCZ · Note
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities · Note
• http://securityfocus.com/bid/93874 · Note