Back to Database
Status published
High
CVE-2016-6546
iTrack Easy mobile application stores the user password in base-64 encoding/cleartext
Vulnerability Description
The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-6546
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability.
References
More from iTrack
View All →CVE-2016-6545
iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request
Critical
9.8
CVE-2016-6544
iTrack Easy's getgps data can be modified without authentication
High
7.5
CVE-2016-6543
A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data
Medium
5.9
CVE-2016-6542
The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device
Low
3.7
Affected Vendor
iTrack
View all reports →Affected Software
Easy
Vulnerable Versions:
Unknown
Timeline
Official Publish:
July 13th, 2018
Last Modified:
August 6th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.