TI-2022-01982 CVE-2022-2141 · GHSA-59rr-qhh3-g554
ICSA-22-200-01 MiCODUS MV720 GPS tracker Improper Authentication
Priority MEDIUM 52
SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.
MiCODUS
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
MiCODUS records in CISA KEVNo MiCODUS vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Mv720 Firmware · all components
TI-2022-01950 CVE-2022-2107 · GHSA-xvm4-2pvm-hp3g
ICSA-22-200-01 MiCODUS MV720 GPS tracker Use of Hard-coded Credentials
Priority MEDIUM 52
The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password.
TI-2022-02035 CVE-2022-2199 · GHSA-3qv5-4cw7-x42h
ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site Scripting
Priority LOW 36
The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.
TI-2022-15066 CVE-2022-34150 · GHSA-7mhv-mcwq-rh85
ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key
Priority LOW 32
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.
TI-2022-14947 CVE-2022-33944 · GHSA-rx38-xpj5-528c
ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key
Priority LOW 31
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.