CVE-2016-6540

TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users

State: Published
Severity: Not scored
Published: Jul 6, 2018
Updated: Aug 6, 2024
Reserved: Aug 3, 2016

Read the record on cve.org

Description

Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Scores

The record has no CVSS score.

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
Bravo Mobile ApplicationTrackR	5.1.6Not affected
Bravo Mobile ApplicationTrackR	2.2.5Not affected

References

93874vdb-entry
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
VU#617567third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.