CVE-2012-2567: The Xelex MobileTrack application 2.3.7 and earlier for Android uses hardcoded credentials, which allows re...

Security readout for executives and security teams

Xelex MobileTrack for Android 2.3.7 and earlier reportedly embeds credentials and sends sensitive activity over unencrypted FTP or HTTP. If still used, information could be exposed to remote attackers. The provided sources do not include a CVSS score, confirmed fix, or active exploitation evidence. Exposure is likely limited to environments that still use Xelex MobileTrack Android 2.3.7 or earlier. Risk is higher where affected devices transmit data over networks that are untrusted, monitored, or shared. Treat this as a targeted legacy exposure issue. It is not documented as actively exploited, but hardcoded credentials and unencrypted transport can create avoidable data exposure if the application remains deployed. Mitigation focus: Inventory Android devices for Xelex MobileTrack 2.3.7 or earlier.; Check Xelex, CERT/CC, and advisory guidance for fixes or replacements.; Remove or replace unsupported affected installations where feasible..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.