CVE-2016-6539
LOWTrackr Firmware < 2.2.5 (Android) and < 5.1.6 (iOS) - Unauthorized Device Tracking via BLE MAC Address Exposure
Title source: llmDescription
The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/93874
Third Party Advisory, US Government Resource x_refsource_misc
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/617567
Scores
CVSS v3
3.5
EPSS
0.0129
EPSS Percentile
66.7%
Attack Vector
ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (2)
thetrackr/trackr_firmware
< 2.2.5
thetrackr/trackr_firmware
< 5.1.6
Published
Jul 06, 2018
Tracked Since
Feb 18, 2026