The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device

Published 8 y ago 2018-07-13 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.7

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.7%

percentile 78%

Public exploits

none known

The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address.

Exploit prediction (EPSS)

1.75% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	3.7	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`

Affected products

iTrack Easy

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-20 Improper Input Validation

References

kb.cert.org /vuls/id/974055 · third-party-advisory, x_refsource_CERT-VN, x_transferred
blog.rapid7.com /2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ · x_refsource_MISC, x_transferred
securityfocus.com /bid/93875 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2016-6542
NVD: CVE-2016-6542

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.