{"cve":"CVE-2014-10374","nvd":{"published":"2019-07-15T13:15:10.967","modified":"2026-06-17T00:04:12.177","status":"Modified","description":"On Fitbit activity-tracker devices, certain addresses never change. According to the popets-2019-0036.pdf document, this leads to \"permanent trackability\" and \"considerable privacy concerns\" without a user-accessible anonymization feature. The devices, such as Charge 2, transmit Bluetooth Low Energy (BLE) advertising packets with a TxAdd flag indicating random addresses, but the addresses remain constant. If devices come within BLE range at one or more locations where an adversary has set up passive sniffing, the adversary can determine whether the same device has entered one of these locations.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-200"],"references":["https://petsymposium.org/2019/files/papers/issue3/popets-2019-0036.pdf","https://twitter.com/TedOnPrivacy/status/1151390589990187008","https://petsymposium.org/2019/files/papers/issue3/popets-2019-0036.pdf","https://twitter.com/TedOnPrivacy/status/1151390589990187008"],"products":["fitbit:charge_2_firmware"],"source":"nvd","synced_at":"2026-10-19T20:58:11.797917892+00:00"},"epss":{"cve":"CVE-2014-10374","score":0.00637,"percentile":0.50542,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}