CVE-2016-6545 - CVE House

Back to Database

Status published Critical CVE-2016-6545

iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request

9.8 CVSS

Vulnerability Description

Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-6545

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability.

References

More from iTrack

View All →

iTrack Easy mobile application stores the user password in base-64 encoding/cleartext

iTrack Easy's getgps data can be modified without authentication

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data

The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device

Affected Vendor

iTrack

View all reports →

Affected Software

Easy

Vulnerable Versions:

Unknown

Timeline

Official Publish: July 13th, 2018

Last Modified: August 6th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1539 Steal Web Session Cookie

Credential Access

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1021 Remote Services

Lateral Movement

T1562 Impair Defenses

Defense Evasion