CVE-2022-33944 - ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

Back Back to CVE browser

MEDIUM

ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

Published Jul 20, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.99%

Description

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.

Affected products

Vendor MiCODUS Product n/a Default
n/a
- Version
  All versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MiCODUS

n/a

Version	Status	Constraints
All versions	affected	-

Remediation

Vendor solution

As of July 18th, 2022, MiCODUS has not provided updates or patches to mitigate these vulnerabilities. CISA will update the corresponding ICSA to reflect any patches, updates, or mitigation information provided by MiCODUS in the future.

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-36980
Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
x_refsource_CONFIRMThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-36980		Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01		x_refsource_CONFIRMThird Party AdvisoryUS Government Resource