CVE-2016-6540
TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users
- Published
- Updated
- Reserved
- Assigned by
- certcc
Description
Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
Timeline
ID reserved
By certcc
- 23 months later
· 23 months later
Published
- 6 years later
· 6 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Medium6.5 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.91% · top 40% of all CVEs (8 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
TrackR · Bravo Mobile Application
- unaffected 5.1.6
TrackR · Bravo Mobile Application
- unaffected 2.2.5
References (4)
- 93874 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ (opens in a new tab)x_refsource_MISCx_transferred
- https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ (opens in a new tab)x_refsource_MISCx_transferred
- VU#617567 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2016-6540)Record last updated .