CVE-2016-6539

🗓️ 06 Jul 2018 21:00:00Reported by certccType

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541

Reporter	Title	Published	Views	Family All 10
CNVD	TrackR Bravo Information Disclosure Vulnerability	28 Oct 201600:00	–	cnvd
Cvelist	CVE-2016-6539 TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID	6 Jul 201821:00	–	cvelist
EUVD	EUVD-2016-7460	7 Oct 202500:30	–	euvd
NVD	CVE-2016-6539	6 Jul 201821:29	–	nvd
OSV	CVE-2016-6539	6 Jul 201821:29	–	osv
Prion	Code injection	6 Jul 201821:29	–	prion
Prion	Code injection	6 Jul 201821:29	–	prion
Prion	Improper access control	6 Jul 201821:29	–	prion
Prion	Code injection	6 Jul 201821:29	–	prion
CERT	TrackR Bravo contains multiple vulnerabilities	25 Oct 201600:00	–	cert

NVD

Node

thetrackr trackr_firmwareRange<2.2.5android

thetrackr trackr_firmwareRange<5.1.6iphone_os

AND

thetrackr trackrMatch-

[
  {
    "platforms": [
      "iOS"
    ],
    "product": "Bravo Mobile Application",
    "vendor": "TrackR",
    "versions": [
      {
        "status": "unaffected",
        "version": "5.1.6"
      }
    ]
  },
  {
    "platforms": [
      "Android"
    ],
    "product": "Bravo Mobile Application",
    "vendor": "TrackR",
    "versions": [
      {
        "status": "unaffected",
        "version": "2.2.5"
      }
    ]
  }
]

Source	Link
kb	www.kb.cert.org/vuls/id/TNOY-AF3KCZ
securityfocus	www.securityfocus.com/bid/93874
blog	www.blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/
kb	www.kb.cert.org/vuls/id/617567

17 Jun 2026 00:51Current

6.2Medium risk

Vulners AI Score6.2

CVSS 23.3

CVSS 33.5

EPSS0.01286

CWE-200