Vulnerability · Published Jul 20, 2022 · Assigned by icscert

CVE-2022-2107ICSA-22-200-01 MiCODUS MV720 GPS tracker Use of Hard-coded Credentials

Critical 9.8

In plain English

A critical-severity hard-coded credentials in MV720 from MiCODUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.3%top 28.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.

Affected products (as reported)

Vendor	Product	Versions
MiCODUS	MV720	All versions

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01 x_refsource_CONFIRM