What’s Vulnerable › Vulnerabilities

CVE-2016-6541: TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-06 · updated 2026-06-17
• Weakness: CWE-306

Description

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Affected products

• Thetrackr Trackr Bravo Firmware: before 2.2.5; before 5.1.6 — fixed in 2.2.5, 5.1.6

How to fix

Upgrade to a fixed version: Thetrackr Trackr Bravo Firmware 2.2.5, 5.1.6. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/93874
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
• https://www.kb.cert.org/vuls/id/617567
• https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ
• http://www.securityfocus.com/bid/93874
• https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
• https://www.kb.cert.org/vuls/id/617567
• https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ

Get alerted when CVE-2016-6541 or the next vulnerability affects your stack