PT-2018-4945 · Itrack · Itrack Easy

Adam Compton + 1 · Published 2018-07-13 · Updated 2019-10-09 · CVE-2016-6544

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions iTrack Easy (affected versions not specified)

Description The issue allows modification of getgps data without authentication by utilizing the cmd:setothergps parameter. This can be exploited to alter the GPS data of a lost device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2016-6544

Affected Products

Itrack Easy

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-6544 · Security Note
• http://securityfocus.com/bid/93875 · Note
• https://kb.cert.org/vuls/id/974055 · Note
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities · Note