Read the docs
TI-2016-05603 Aliases CVE-2016-6539GHSA-3hvh-frvh-wpp7

TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID

Priority LOW 19CWE-200Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Why it matters now

EPSS 0.01286 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Bravo Mobile Application (TrackR): 5.1.6, 2.2.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TrackRBravo Mobile Application—5.1.6Patch availableCNA
TrackRBravo Mobile Application—2.2.5Patch availableCNA
  • Bravo Mobile Application VendorTrackR Affected — Fixed in 5.1.6 Patch available CNA
  • Bravo Mobile Application VendorTrackR Affected — Fixed in 2.2.5 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:thetrackr:trackr_firmware:*:*:*:*:*:android:*:*before 2.2.5VulnerableTrackR
cpe:2.3:o:thetrackr:trackr_firmware:*:*:*:*:*:iphone_os:*:*before 5.1.6VulnerableTrackR
cpe:2.3:h:thetrackr:trackr:-:*:*:*:*:*:*:*not specified by NVDRunning onTrackR
  • cpe:2.3:o:thetrackr:trackr_firmware:*:*:*:*:*:android:*:* Versions before 2.2.5 Vulnerable ·TrackR
  • cpe:2.3:o:thetrackr:trackr_firmware:*:*:*:*:*:iphone_os:*:* Versions before 5.1.6 Vulnerable ·TrackR
  • cpe:2.3:h:thetrackr:trackr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TrackR

Remediation

  • Fix · CNA Bravo Mobile Application (TrackR) Fixed in 5.1.6
  • Fix · CNA Bravo Mobile Application (TrackR) Fixed in 2.2.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6539
  2. 2026-10-03 Alias added: GHSA-3hvh-frvh-wpp7

References

Exploit 1

Advisory 2

  • TI-2020-10529 TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm)… CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences