title: TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes
description: TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
problem types: CWE-306: Missing Authentication for Critical Function
affected:
{
platforms: iOS
product: Bravo Mobile Application
vendor: TrackR
versions:
status: unaffected, version: 5.1.6
}
{
platforms: Android
product: Bravo Mobile Application
vendor: TrackR
versions:
status: unaffected, version: 2.2.5
}
