CVE-2022-33944

—

CVSS 3.1

6.5 medium

EPSS

<1%p58

Published

Jul 20, 2022 (Jul 20, 2022)

Modified

Jun 17, 2026

Description

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.

Vendors: micodus
Products: mv720 firmware
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news3 stories

Unpatched Flaws in Popular GPS Devices Allow Adversaries to Disrupt and Track Vehicles

Infosecurity MagazineJul 20, 18:48 UTC · Jul 20, 2022Vulnerability CVE-2022-2107 CVE-2022-2141 CVE-2022-2199+2 CVEs

Million of vehicles can be hit via MiCODUS MV720 GPS Tracker

Security AffairsJul 20, 14:53 UTC · Jul 20, 2022Vulnerability CVE-2022-2107 CVE-2022-2141 CVE-2022-2199+2 CVEs

Unpatched GPS Tracker Bugs Could Let Attackers Disrupt Vehicles Remotely

The Hacker NewsJul 20, 09:44 UTC · Jul 20, 2022Vulnerability CVE-2022-2107 CVE-2022-2141 CVE-2022-2199+2 CVEs