CVE-2016-6542 The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device

Low 3.7 Published 13 Jul 2018 Updated 6 Aug 2024

An attacker within range can obtain the iTrack Easy device's MAC address and tracking ID, exposing unique device identifiers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2016-6542?

CVE-2016-6542 is a low-severity vulnerability in iTrack Easy, published on 13 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address.

Weakness: CWE-20, CWE-200

Which versions are affected by CVE-2016-6542?

It affects 1 product.

Products include Ieasytec Itrackeasy.

How do I fix CVE-2016-6542?

No fix has been published for CVE-2016-6542 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-6542 being exploited?

There is no known exploitation of CVE-2016-6542 in the wild and no public exploit code.

CVE-2016-6545 iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request Critical 9.8

Sources

Also known as GHSA-xhgf-3v3f-px6x.