CVE-2016-6538CWE-313

TrackR Bravo mobile application stores account passwords in cleartext

published July 6, 2018

CVSS
—
EPSS
1%
Percentile
63.9
In the wild
Unconfirmed
What it is

The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01055 · 63.9th percentile
Weakness
CWE-313 · Cleartext Storage in a File or on Disk
Published
2018-07-06T21:00Z
EPSS history
Timeline
  • 06 JUL 21:00Z
    TrackR Bravo mobile application stores account passwords in cleartext
    cvelistv5