CVE-2016-6545
iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request
CVE-2016-6545 is a critical vulnerability (CVSS 9.8) in Itrack Easy, published July 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.02%, the 87th percentile. No source names a fixed version.
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password.
- Record
CVE-2016-6545- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-613, CWE-384
- Updated
- 2026-11-02
CVE List No score
iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password.
- Record
CVE-2016-6545- Weakness
- CWE-613
- Updated
- 2026-11-02
EUVDEUVD-2016-7466 No score
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password.
- Record
EUVD-2016-7466- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8wxv-6xp4-q7px
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password...
Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password.
- Record
GHSA-8wxv-6xp4-q7px- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |