CVE-2016-6538 TrackR Bravo mobile application stores account passwords in cleartext
HighCVSS 8.8
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thetrackr trackr bravo firmware | < 2.2.5 | 2.2.5 |
| thetrackr trackr bravo firmware | < 5.1.6 | 5.1.6 |
References
- 93874 third-party-advisory vdb-entry
- blog.rapid7.com exploit third-party-advisory
- VU#617567 third-party-advisory us-government-resource
- www.kb.cert.org third-party-advisory us-government-resource