CVE-2016-6544: vulnerability in iTrack Easy
iTrack Easy's getgps data can be modified without authentication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 3.3%
getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps. This vulnerability can be exploited to alter the GPS data of a lost device.
Affected products
iTrack · EasyRelated CVEs — iTrack Easy
In the same product, most dangerous first.
CVE-2016-6545—iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each requestEPSS 3.0%CVE-2016-6543—A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS dataEPSS 2.1%CVE-2016-6542—The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the deviceEPSS 1.7%CVE-2016-6546—iTrack Easy mobile application stores the user password in base-64 encoding/cleartextEPSS 0.4%