CVE-2016-6538 - CVE House
Back to Database
Status published High CVE-2016-6538

TrackR Bravo mobile application stores account passwords in cleartext

Vulnerability Description

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-6538

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability.

References

More from TrackR

View All →
CVE-2016-6541
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes
High 8.8
CVE-2016-6540
TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users
Medium 6.5
CVE-2016-6539
TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID
Low 3.5

Affected Vendor

Affected Software

Bravo Mobile Application
Vulnerable Versions:
5.1.6, 2.2.5

Timeline

Official Publish: July 6th, 2018
Last Modified: August 6th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-313

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.