Back to Database
Status published
Low
CVE-2016-6542
The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device
Vulnerability Description
The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-6542
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability.
References
More from iTrack
View All →CVE-2016-6546
iTrack Easy mobile application stores the user password in base-64 encoding/cleartext
High
7.8
CVE-2016-6545
iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request
Critical
9.8
CVE-2016-6544
iTrack Easy's getgps data can be modified without authentication
High
7.5
CVE-2016-6543
A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data
Medium
5.9
Affected Vendor
iTrack
View all reports →Affected Software
Easy
Vulnerable Versions:
Unknown
Timeline
Official Publish:
July 13th, 2018
Last Modified:
August 6th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N