CVE-2016-6539

TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID

State: Published
Severity: Not scored
Published: Jul 6, 2018
Updated: Aug 6, 2024
Reserved: Aug 3, 2016

Description

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Scores

The record has no CVSS score.

Weaknesses

CWE-200 Information Exposure

Affected Products

Product	Versions
Bravo Mobile ApplicationTrackR	5.1.6Not affected
Bravo Mobile ApplicationTrackR	2.2.5Not affected

References

93874vdb-entry
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
VU#617567third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.