Mobile Defense has reported two vulnerabilities in Xelex MobileTrack, which can be exploited by malicious people to disclose sensitive information and bypass certain security restrictions.

1) The application uses hardcoded credentials for the FTP server, which can be exploited to disclose other users' data.

2) The application does not verify the source when parsing commands via SMS, which can be exploited to execute administrative commands on the device.

The vulnerabilities are reported in version 2.1.4. Other versions may also be affected.

Solution
The vendor is currently working on fixes.

Provided and/or discovered by
Mobile Defense.

Original Advisory
http://blog.mobiledefense.com/2012/05/mobile-defense-finds-two-security-vulnerabilities-in-xelex-mobiletrack/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers