Back to Database
Status published
Medium
CVE-2016-6543
A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data
Vulnerability Description
A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-6543
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability.
References
More from iTrack
View All →CVE-2016-6546
iTrack Easy mobile application stores the user password in base-64 encoding/cleartext
High
7.8
CVE-2016-6545
iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request
Critical
9.8
CVE-2016-6544
iTrack Easy's getgps data can be modified without authentication
High
7.5
CVE-2016-6542
The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device
Low
3.7
Affected Vendor
iTrack
View all reports →Affected Software
Easy
Vulnerable Versions:
Unknown
Timeline
Official Publish:
July 13th, 2018
Last Modified:
August 6th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.