Adam Compton

The issue allows unauthenticated Bluetooth pairing, enabling unauthenticated connected applications to write data to the `device name` attribute.

The issue concerns the session management in iTrack Easy. Specifically, session cookies are not utilized to maintain valid sessions. Instead, the user's password is transmitted as a POST parameter over HTTPS on every request, using a base64 encoded `passwd` field. This means that sessions can only be terminated when the user changes the associated password.

The issue concerns the storage of account passwords in the iTrack Easy mobile application. Specifically, the application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. Since base64 encoding is considered equivalent to cleartext, this poses a significant security risk.

The issue concerns the storage of account passwords in cleartext within the cache.db file of the app, which is used for authentication to the cloud API.

The issue concerns the Zizai Tech Nut mobile app making requests via HTTP instead of HTTPS, which includes the user's authenticated session token in the URL. This allows an attacker to capture these requests and reuse the session token, potentially gaining full access to the user's account.

The issue concerns the iTrack device, where the tracking ID number, also referred to as "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address.

The issue allows a captured MAC or device ID of an iTrack Easy to be registered under multiple user accounts, enabling access to getgps GPS data. This can permit unauthenticated parties to track the device.

The issue allows modification of getgps data without authentication by utilizing the `cmd:setothergps` parameter. This can be exploited to alter the GPS data of a lost device.

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.