Skip to content
OpenAdvisories
Critical ICSA-22-200-01 5 CVEs

MiCODUS MV720 GPS tracker

Published Jul 19, 2022 · Updated Sep 20, 2022 · Revision 2

Vendor: MiCODUS Product: MV720 GPS tracker

Summary

Successful exploitation of these vulnerabilities could allow an attacker control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands, and the disarming of various features (e.g., alarms).

Vulnerabilities 5

  • Critical 9.8
    CVE-2022-2107

    ICSA-22-200-01 MiCODUS MV720 GPS tracker Use of Hard-coded Credentials

    The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile nu…

    MiCODUS MV720
  • Critical 9.8
    CVE-2022-2141

    ICSA-22-200-01 MiCODUS MV720 GPS tracker Improper Authentication

    SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.

    MiCODUS MV720
  • High 7.5
    CVE-2022-2199

    ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site Scripting

    The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.

    MiCODUS MV720
  • High 7.1
    CVE-2022-34150

    ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

    The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.

    MiCODUS MV720
  • Medium 6.5
    CVE-2022-33944

    ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

    The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.

    MiCODUS MV720

Revision history

  1. #2

    MiCODUS MV720 GPS tracker (Update A)

  2. #1

    MiCODUS MV720 GPS tracker (Update A)

References