CVE-2022-2107

—

CVSS 3.1

9.8 critical

EPSS

1%p67

Published

Jul 20, 2022 (Jul 20, 2022)

Modified

Jun 17, 2026

Description

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.

Vendors: micodus
Products: mv720 firmware
Weakness: CWE-798
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news4 stories

Unpatched flaws in popular GPS devices could let hackers disrupt and track vehicles

The RecordJan 11, 00:00 UTC · Jan 11, 2023Vulnerability CVE-2022-2107 CVE-2022-2141

Unpatched Flaws in Popular GPS Devices Allow Adversaries to Disrupt and Track Vehicles

Infosecurity MagazineJul 20, 18:48 UTC · Jul 20, 2022Vulnerability CVE-2022-2107 CVE-2022-2141 CVE-2022-2199+2 CVEs

Million of vehicles can be hit via MiCODUS MV720 GPS Tracker

Security AffairsJul 20, 14:53 UTC · Jul 20, 2022Vulnerability CVE-2022-2107 CVE-2022-2141 CVE-2022-2199+2 CVEs

Unpatched GPS Tracker Bugs Could Let Attackers Disrupt Vehicles Remotely

The Hacker NewsJul 20, 09:44 UTC · Jul 20, 2022Vulnerability CVE-2022-2107 CVE-2022-2141 CVE-2022-2199+2 CVEs