CVE-2022-2107 - ICSA-22-200-01 MiCODUS MV720 GPS tracker Use of Hard-coded Credentials

Back Back to CVE browser

CRITICAL

ICSA-22-200-01 MiCODUS MV720 GPS tracker Use of Hard-coded Credentials

Published Jul 20, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.31%

Description

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.

Affected products

Vendor MiCODUS Product n/a Default
n/a
- Version
  All versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MiCODUS

n/a

Version	Status	Constraints
All versions	affected	-

Remediation

Vendor solution

As of July 18th, 2022, MiCODUS has not provided updates or patches to mitigate these vulnerabilities. CISA will update the corresponding ICSA to reflect any patches, updates, or mitigation information provided by MiCODUS in the future.

Weaknesses (1)

CWE-798

Hard-coded Credentials