CVE-2022-33944
published 2022-07-20CVE-2022-33944: The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,”…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.87%
54.1th percentile
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| micodus | mv720 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
MiCODUS MV720 GPS tracker (Update A)
cisa_ics·2022-07-19·CVSS 9.8
[CRITICAL] MiCODUS MV720 GPS tracker (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
MiCODUS MV720 GPS tracker (Update A)
Last RevisedSeptember 20, 2022
Alert CodeICSA-22-200-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: MiCODUS
- Equipment: MV720 GPS tracker
- Vulnerabilities: Use of Hard-coded Credentials, Improper Authentication, Cross-site Scripting, Authorization Bypass Through User-controlled Key
## 2. UPDATE OR REPOSTED INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-22-200-01 MiCODUS MV720 GPS tracker that was published July 19, 2022, on the ICS webpa
GHSA
GHSA-rx38-xpj5-528c: The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Dev
ghsa_unreviewed·2022-07-21
CVE-2022-33944 [MEDIUM] CWE-639 GHSA-rx38-xpj5-528c: The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Dev
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-07-20
Published