CVE-2016-6546: vulnerability in iTrack Easy
iTrack Easy mobile application stores the user password in base-64 encoding/cleartext
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.4%
The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext.
Affected products
iTrack · EasyRelated CVEs — iTrack Easy
In the same product, most dangerous first.
CVE-2016-6544—iTrack Easy's getgps data can be modified without authenticationEPSS 3.3%CVE-2016-6545—iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each requestEPSS 3.0%CVE-2016-6543—A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS dataEPSS 2.1%CVE-2016-6542—The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the deviceEPSS 1.7%