Vulnerability · Published Jul 20, 2022 · Assigned by icscert

CVE-2022-2199ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site Scripting

High 7.5

In plain English

A high-severity cross-site scripting in MV720 from MiCODUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 46.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.

Affected products (as reported)

Vendor	Product	Versions
MiCODUS	MV720	All versions

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01 x_refsource_CONFIRM