CVE-2016-6546 iTrack Easy mobile application stores the user password in base-64 encoding/cleartext
The iTrack Easy mobile app stores user passwords in base64 encoding, allowing attackers with device access to retrieve credentials and take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6546?
CVE-2016-6546 is a high-severity vulnerability in iTrack Easy, published on 13 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext.
Which versions are affected by CVE-2016-6546?
It affects 1 product.
Products include Kkmcn Itrackeasy.
How do I fix CVE-2016-6546?
No fix has been published for CVE-2016-6546 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-6546 being exploited?
There is no known exploitation of CVE-2016-6546 in the wild and no public exploit code.
Sources
Also known as GHSA-4fv4-f7m5-w88w.