PT-2018-4942 · Trackr+1 · Bravo Mobile Application+1

Adam Compton + 1 · Published 2018-07-06 · Updated 2019-10-09 · CVE-2016-6541

OSV

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2016-6541

Affected Products

Bravo Mobile Application

Trackr Bravo Firmware

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-6541 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6541 · Vendor Advisory
• https://kb.cert.org/vuls/id/617567 · Note
• https://kb.cert.org/vuls/id/TNOY-AF3KCZ · Note
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities · Note
• http://securityfocus.com/bid/93874 · Note