CVE-2016-6540 — TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthent…

Description (CNA)

Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Affected (CNA)

Vendor / product	Versions
TrackR / Bravo Mobile Application	unaffected 5.1.6
TrackR / Bravo Mobile Application	unaffected 2.2.5

CWE

CWE-306

References

http://www.securityfocus.com/bid/93874
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
https://www.kb.cert.org/vuls/id/617567

ADP enrichment

CVE

No English description supplied.

http://www.securityfocus.com/bid/93874
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
https://www.kb.cert.org/vuls/id/617567