Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2016-6545: iTrack Easy sends password with every request
CVE-2016-6545 · published 8 years ago
Summary
iTrack Easy includes the user’s password in each web request instead of using a session cookie. This means the password is repeatedly transmitted, and the session can only end when the password is changed. Update to a version that uses proper session handling or work with the vendor to fix the login process.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ieasytec | itrackeasy |
All versions
cpe:2.3:a:ieasytec:itrackeasy:-:*:*:*:*:*:*:* |
Original advisory text
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In thi...
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password.
References
- http://www.securityfocus.com/bid/93875 Third Party Advisory VDB Entry
- https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vul... Third Party Advisory
- https://www.kb.cert.org/vuls/id/974055 Third Party Advisory US Government Resource
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-613Insufficient Session Expiration
CWE-384Session Fixation
Timeline
Published13 Jul 2018
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-6545 · NVD
Track software like this
Free during beta