CVE-2016-6538
Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.05% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-313, CWE-200, CWE-255
- Affected
- thetrackr/trackr bravo firmware
- Source
- cret@cert.org
References
- http://www.securityfocus.com/bid/93874Third Party Advisory, VDB Entry
- https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/Exploit, Third Party Advisory
- https://www.kb.cert.org/vuls/id/617567Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/TNOY-AF3KCZThird Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/93874Third Party Advisory, VDB Entry
- https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/Exploit, Third Party Advisory
- https://www.kb.cert.org/vuls/id/617567Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/TNOY-AF3KCZThird Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.