CVE-2016-6541 TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes
HighCVSS 8.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thetrackr trackr bravo firmware | < 2.2.5 | 2.2.5 |
| thetrackr trackr bravo firmware | < 5.1.6 | 5.1.6 |
References
- 93874 third-party-advisory vdb-entry
- blog.rapid7.com third-party-advisory
- VU#617567 third-party-advisory us-government-resource
- www.kb.cert.org third-party-advisory us-government-resource