Description
The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MiCODUS | MV720 | All versions | — |
Advisories 1
- ICSA-22-200-01 MiCODUS MV720 GPS tracker CISA ICS & IT advisories · Sep 20, 2022