CVEvulnerability

CVE-2016-6538

8.8 HIGH Published 2018-07-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-07-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
3.3 LOW — AV:A/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-255, CWE-313

Description

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Affected configurations

• thetrackr trackr bravo firmware (< 2.2.5) • thetrackr trackr bravo firmware (< 5.1.6)

Related

Weakness · not in database (1)

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-313 Cleartext Storage in a File or on Disk weakness

References