Vendors / TrackR Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 3
Exploited now TrackR records in CISA KEV No TrackR vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 40
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes.
CVSS 3.0 HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.01093 · Published 2018-07-06 · Fixed in 5.1.6, 2.2.5 CWE-306
Priority MEDIUM 40
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.
CVSS 3.0 HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.01055 · Published 2018-07-06 · Fixed in 5.1.6, 2.2.5 CWE-313
Priority LOW 32
TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventually cause a denial of service when battery capacity is exhausted.
CVSS 3.1 HIGH 7.1· Adjacent network · No auth · No interaction · EPSS 0.00565 · Published 2020-05-23 · No fix listed CWE-862
Priority LOW 31
Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-20…
CVSS 3.0 MEDIUM 6.5· Adjacent network · No auth · No interaction · EPSS 0.0091 · Published 2018-07-06 · Fixed in 5.1.6, 2.2.5 CWE-306
Priority LOW 19
The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse.
CVSS 3.0 LOW 3.5· Adjacent network · No auth · User interaction · EPSS 0.01286 · Published 2018-07-06 · Fixed in 5.1.6, 2.2.5 CWE-200
Open these records in search → All records by CVSS severity
0 3 1 1 0
THREATIST.IORead the docs