CVE-2016-6538: TrackR Bravo mobile application stores account passwords in cleartext

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-06 · updated 2026-06-17
Weakness: CWE-313

Description

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Affected products

Thetrackr Trackr Bravo Firmware: before 2.2.5; before 5.1.6 — fixed in 2.2.5, 5.1.6

How to fix

Upgrade to a fixed version: Thetrackr Trackr Bravo Firmware 2.2.5, 5.1.6. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/93874
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
https://www.kb.cert.org/vuls/id/617567
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
http://www.securityfocus.com/bid/93874
https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
https://www.kb.cert.org/vuls/id/617567
https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ

Get alerted when CVE-2016-6538 or the next vulnerability affects your stack