1. Home
  2. CVE Database
  3. CVE-2022-2107
CRITICAL · 9.8

CVE-2022-2107

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tr...

Vulnerability Description

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
MicodusMv720 Firmware-
MicodusMv720-

Related Weaknesses (CWE)

CWE-798

References

FAQ

What is CVE-2022-2107?

CVE-2022-2107 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tr...

How severe is CVE-2022-2107?

CVE-2022-2107 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-2107?

Check the references section above for vendor advisories and patch information. Affected products include: Micodus Mv720 Firmware, Micodus Mv720.