CVE-2020-17485

A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse shell. An attacker could then run commands, browse system files, and browse local resources...

CVE-2020-17483

An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have...

A week in security (August 19 – August 25)

Last week on Malwarebytes Labs: Millennials’ sense of privacy uniquely tested in romantic relationships Hacked GPS tracker reveals location data of customers "We will hold them accountable": General Motors sued for selling customer driving data to third parties Why you need to know about ransomwa...

Hacked GPS tracker reveals location data of customers

Stalkerware researcher maia arson crimew strikes again. Big time. We know maia as a researcher that loves to go after stalkerware peddlers, which Malwarebytes—as one of the founding members of the Coalition Against Stalkerware—loves to see. This time the target company, Tracki, is one selling GPS...

CVE-2020-17485

A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse shell. An attacker could then run commands, browse system files, and browse local resources...

CVE-2020-17484

An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain...

CVE-2020-17483

An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have...

Open redirect

An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain...

Improper access control

An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have...

PT-2023-11481 · Uffizio · Uffizio'S Gps Tracker

Name of the Vulnerable Software and Affected Versions: Uffizio's GPS Tracker all versions Description: An improper access control issue exists, leading to sensitive information disclosure of connected devices. Visiting the vulnerable host at port 9000 returns a JSON body with details about deploy...

CVE-2020-17484

An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain...

CVE-2020-17485

A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse shell. An attacker could then run commands, browse system files, and browse local resources...

CVE-2020-17485

CVE-2020-17485 affects Uffizio’s GPS Tracker (all versions) and describes a Remote Code Execution via the web server by uploading and executing a web/reverse shell. The vulnerability path allows an attacker to upload a dangerous file and then run commands, browse system files, and access local re...

PT-2023-11482 · Uffizio · Uffizio'S Gps Tracker

Name of the Vulnerable Software and Affected Versions: Uffizio's GPS Tracker affected versions not specified Description: An Open Redirection issue exists, allowing an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain. Recommendations: At...

CVE-2020-17483

An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected devices. By visiting the vulnerable host at port 9000, we see it responds with a JSON body that has all the details about the devices which have...

CVE-2020-17483

Summary: CVE-2020-17483 affects Uffizio's GPS Tracker (all versions) due to an improper access control (CWE-284) that allows disclosure of sensitive information for all connected devices. Access via port 9000 returns a JSON payload detailing deployed devices, implying potential exposure over the ...

CVE-2020-17484

CVE-2020-17484 : Uffizio’s GPS Tracker (all versions) has an Open Redirect vulnerability. An attacker can craft a URL within the application to redirect victims to an arbitrary external domain due to insufficient input/URL validation. Impact is described as redirecting to an external site; exploi...

Critical Vulnerability in Popular GPS Tracker Lets Hackers Remotely Control Vehicles

By Deeba Ahmed The MV720 GPS tracker is manufactured by a China-based company MiCODUS which was informed about the flaws back… This is a post from HackRead.com Read the original post: Critical Vulnerability in Popular GPS Tracker Lets Hackers Remotely Control Vehicles...

Critical Vulnerabilities in GPS Trackers

This is a dangerous vulnerability: An assessment from security firm BitSight found six vulnerabilities in the Micodus MV720, a GPS tracker that sells for about $20 and is widely available. The researchers who performed the assessment believe the same critical vulnerabilities are present in other...

Vulnerabilities in GPS tracker could have “life-threatening” implications

Researchers at BitSight have discovered six vulnerabilities in the MiCODUS MV720 GPS tracker, a popular vehicle tracking device. The vulnerabilities are severe enough for the Cybersecurity & Infrastructure Security Agency CISA to publish a Security Advisory titled ICSA-22-200-01: MiCODUS MV720 GP...