What’s Vulnerable › Vulnerabilities

CVE-2016-6539: TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID

• Severity: low (CVSS 3.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-07-06 · updated 2026-06-17
• Weakness: CWE-200

Description

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Affected products

• Thetrackr Trackr Firmware: before 2.2.5; before 5.1.6 — fixed in 2.2.5, 5.1.6

How to fix

Upgrade to a fixed version: Thetrackr Trackr Firmware 2.2.5, 5.1.6. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/93874
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
• https://www.kb.cert.org/vuls/id/617567
• https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
• http://www.securityfocus.com/bid/93874
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
• https://www.kb.cert.org/vuls/id/617567
• https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ

Get alerted when CVE-2016-6539 or the next vulnerability affects your stack