CVE-2016-6541 - CVE House
Back to Database
Status published High CVE-2016-6541

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes

Vulnerability Description

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-6541

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability.

References

More from TrackR

View All →
CVE-2016-6540
TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users
Medium 6.5
CVE-2016-6539
TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID
Low 3.5
CVE-2016-6538
TrackR Bravo mobile application stores account passwords in cleartext
High 8.8

Affected Vendor

Affected Software

Bravo Mobile Application
Vulnerable Versions:
5.1.6, 2.2.5

Timeline

Official Publish: July 6th, 2018
Last Modified: August 6th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1136 Create Account
Persistence
T1098 Account Manipulation
Privilege Escalation
T1021 Remote Services
Lateral Movement