vulnwire
5.9med

CVE-2016-6543

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
0
none known

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device.

Exploit prediction (EPSS)

2.13% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • iTrack Easy

Classification

Weakness
  • CWE-799 Improper Control of Interaction Frequency
  • CWE-284 Improper Access Control

References

  • kb.cert.org /vuls/id/974055 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • blog.rapid7.com /2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/93875 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.