High severity · published Jul 6, 2018
CVE-2016-6538
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TB
Trackr Bravo Firmware · Thetrackr
before 2.2.5; before 5.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6538
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6538
Third Party Advisory
http://www.securityfocus.com/bid/93874
Exploit
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
Third Party Advisory
https://www.kb.cert.org/vuls/id/617567
Third Party Advisory
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
More from Trackr Bravo Firmware
8.8
CVE-2016-6541
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes
6.5
CVE-2016-6540
Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which…