Low severity · published Jul 6, 2018
CVE-2016-6539
The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse
3.5
CVSS
1.3%
EPSS
No
On KEV
Description
The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Trackr Firmware · Thetrackr
before 2.2.5; before 5.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6539
Third Party Advisory
http://www.securityfocus.com/bid/93874
Exploit
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
Third Party Advisory
https://www.kb.cert.org/vuls/id/617567
Third Party Advisory
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
More from Trackr Firmware
7.1
CVE-2020-13425
TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventually cause a denial of service when battery capacity is exhausted