CVE-2016-6540
Medium
Description
Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
SeverityMedium
CVSS6.5
Exploit probability—
ProductThetrackr Trackr Bravo Firmware
PublishedJul 6, 2018
First seenJul 6, 2018
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- thetrackr trackr_bravo_firmware2.2.5, 5.1.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thetrackr trackr_bravo_firmware | v < 2.2.5, v < 5.1.6 | 2.2.5, 5.1.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.