CVE-2016-6543: vulnerability in iTrack Easy
A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.1%
A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device.
Affected products
iTrack · EasyRelated CVEs — iTrack Easy
In the same product, most dangerous first.
CVE-2016-6544—iTrack Easy's getgps data can be modified without authenticationEPSS 3.3%CVE-2016-6545—iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each requestEPSS 3.0%CVE-2016-6542—The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the deviceEPSS 1.7%CVE-2016-6546—iTrack Easy mobile application stores the user password in base-64 encoding/cleartextEPSS 0.4%