CVE-2014-10374

On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to "permanent trackability" and "considerable privacy concerns" without a user-accessible anonymization feature. The devices, such as Charge 2, transmit Bluetooth Low Energy (BLE) advertising packets with a TxAdd flag indicating random addresses, but the addresses remain constant. If devices come within BLE range at one or more locations where an adversary has set up passive sniffing, the adversary can determine whether the same device has entered one of these locations.

• CWE-200

• https://petsymposium.org/2019/files/papers/issue3/popets-2019-0036.pdfThird Party Advisory
• https://twitter.com/TedOnPrivacy/status/1151390589990187008Third Party Advisory
• https://petsymposium.org/2019/files/papers/issue3/popets-2019-0036.pdfThird Party Advisory
• https://twitter.com/TedOnPrivacy/status/1151390589990187008Third Party Advisory

Published

Jul 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-10074Umbraco before 7.2.0 has a remote PHP code execution vulnera…
• CVE-2014-10075The karo gem 2.3.8 for Ruby allows Remote command injection …
• CVE-2014-10076The wp-db-backup plugin 2.2.4 for WordPress relies on a five…
• CVE-2014-10077Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem befo…
• CVE-2014-10078Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/…
• CVE-2014-10079In Vembu StoreGrid 4.4.x, the front page of the server web i…
• CVE-2014-10375handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishand…
• CVE-2014-10376The i-recommend-this plugin before 3.7.3 for WordPress has S…
• CVE-2014-10377The cforms2 plugin before 13.2 for WordPress has XSS in lib_…6.1
• CVE-2014-10378The duplicate-post plugin before 2.6 for WordPress has XSS.
• CVE-2014-10379The duplicate-post plugin before 2.6 for WordPress has SQL i…
• CVE-2014-10380The profile-builder plugin before 1.1.66 for WordPress has m…