CVE-2016-6537

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-65388.8The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated appCVE-2016-65393.5The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address CVE-2016-65406.5Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr deviCVE-2016-65418.8TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributCVE-2016-65423.7The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The CVE-2016-65435.9A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can alloCVE-2016-65447.5getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps. This vulnerabilityCVE-2016-65459.8Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS usiCVE-2016-65467.8The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db fileCVE-2016-65477.8The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.CVE-2016-65489.8The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with tCVE-2016-65494.3The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to th