CVE-2022-2199

CVE-2022-2199 affects the MiCODUS MV720 GPS tracker’s main web server, with a reflected cross-site scripting vulnerability that could allow an attacker to execute arbitrary JavaScript by tricking a user into making a request. ICS-CISA notes the vulnerabilities include high-severity XSS and relate...

CVE-2022-2199 ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site Scripting

The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request...

CVE-2022-34150 ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification...

CVE-2022-34150 ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification...

CVE-2022-34150

CVE-2022-34150 affects the MiCODUS MV720 GPS tracker Web server and is an authenticated insecure direct object reference vulnerability on endpoints/parameters for device IDs, enabling an attacker with basic access to manipulate device IDs without further verification (authorization bypass). Publi...

Unpatched GPS Tracker Bugs Could Let Attackers Disrupt Vehicles Remotely — The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency CISA is warning of a handful of unpatched security vulnerabilities in MiCODUS MV720 Global Positioning System GPS trackers outfitted in over 1.5 million vehicles that could lead to remote disruption of critical operations. "Successful...

PT-2022-14860 · Micodus · Micodus Mv720

Name of the Vulnerable Software and Affected Versions: MiCODUS MV720 GPS tracker affected versions not specified Description: The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS...

CVE-2022-2107: Use of Hard-coded Credentials

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number...

CVE-2022-34150: Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification...

PT-2022-15205

Name of the Vulnerable Software and Affected Versions MiCODUS MV720 GPS tracker affected versions not specified Description The main web server of the MiCODUS MV720 GPS tracker has a reflected cross-site scripting issue. This could allow an attacker to gain control by tricking a user into making ...

CVE-2022-2141: Improper Authentication

SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication...

CVE-2022-33944: Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs...

PT-2022-22024

Name of the Vulnerable Software and Affected Versions MiCODUS MV720 GPS tracker affected versions not specified Description The main web server of the MiCODUS MV720 GPS tracker has an authenticated insecure direct object reference issue. This issue is related to the endpoint and parameter device...

PT-2022-14952 · Micodus · Micodus Mv720 Gps Tracker

Name of the Vulnerable Software and Affected Versions: MiCODUS MV720 GPS tracker affected versions not specified Description: The issue allows SMS-based GPS commands to be executed by the MiCODUS MV720 GPS tracker without requiring authentication. Recommendations: At the moment, there is no...

PT-2022-21930

Name of the Vulnerable Software and Affected Versions MiCODUS MV720 GPS tracker affected versions not specified Description The main web server of the MiCODUS MV720 GPS tracker has an authenticated insecure direct object references issue. This issue is related to an endpoint and the POST paramete...

CVE-2022-2199: Improper Neutralization of Input During Web Page Generation

The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request...

MiCODUS MV720 GPS 跨站脚本漏洞

The MiCODUS MV720 GPS is a GPS tracker from MiCODUS USA. The MiCODUS MV720 GPS suffers from a cross-site scripting vulnerability that stems from a reflected cross-site scripting vulnerability in the main web server, which could allow an attacker to gain control by tricking a user into making a...

MiCODUS MV720 GPS 安全漏洞

MiCODUS MV720 GPS is a GPS tracker from MiCODUS Corporation. A security vulnerability exists in the MiCODUS MV720 GPS tracker that originates from an authenticated, insecure direct object reference vulnerability in the main web server on the endpoint and POST parameter "Device ID" that accepts an...

MiCODUS MV720 GPS 安全漏洞

The MiCODUS MV720 GPS is a GPS tracker from MiCODUS USA. A security vulnerability exists in the MiCODUS MV720 GPS that originates from an authenticated and insecure direct object reference vulnerability in the main web server on the endpoint and parameterized device IDs, which accepts arbitrary...

CISA released Security Advisory on MiCODUS MV720 Global Positioning System (GPS) Tracker

CISA has released an Industrial Controls Systems Advisory ICSA detailing six vulnerabilities that were discovered in MiCODUS MV720 Global Positioning System Tracker. Successful exploitation of these vulnerabilities may allow a remote actor to exploit access and gain control the global positioning...