Vulnerabilities

TI-2016-05610 CVE-2016-6546 · GHSA-4fv4-f7m5-w88w

iTrack Easy mobile application stores the user password in base-64 encoding/cleartext

LOW 34

The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00409 Published 2018-07-13 No fix listed CWE-313

TI-2016-05609 CVE-2016-6545 · GHSA-8wxv-6xp4-q7px

iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request

MEDIUM 48

Session cookies are not used for maintaining valid sessions in iTrack Easy.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03021 Published 2018-07-13 No fix listed CWE-613

TI-2016-05608 CVE-2016-6544 · GHSA-cg57-h35j-g58g

iTrack Easy's getgps data can be modified without authentication

LOW 39

getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03306 Published 2018-07-13 No fix listed CWE-306

TI-2016-05607 CVE-2016-6543 · GHSA-pp55-j7w3-7wx3

Improper access control in iTrack Easy

LOW 31

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02131 Published 2018-07-13 No fix listed CWE-799

TI-2016-05606 CVE-2016-6542 · GHSA-xhgf-3v3f-px6x

The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device

LOW 21

The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device.

CVSS 3.0LOW 3.7 Network No auth No interaction EPSS 0.01748 Published 2018-07-13 No fix listed CWE-200