Critical · published July 20, 2022
🚨 No password? No problem! An attacker can execute SMS-based GPS commands on a MiCODUS MV720 tracker without any authentication. 🔥 Imagine a delivery service that allows anyone to change the destination of a package just by sending a text. That's how easily an attacker can take control of a GPS tracker, altering its path at will. This means an attacker could literally redirect the tracker to any location, potentially putting sensitive assets at risk or enabling stalking behavior. The implications are absolutely devastating, particularly for users relying on this device for security and tracking purposes.
Imagine a delivery service that allows anyone to change the destination of a package just by sending a text. That's how easily an attacker can take control of a GPS tracker, altering its path at will. CVE-2022-2141 allows unauthorized execution of SMS commands on the MiCODUS MV720 GPS tracker due to a lack of authentication checks, enabling control over the device remotely.
This means an attacker could literally redirect the tracker to any location, potentially putting sensitive assets at risk or enabling stalking behavior. The implications are absolutely devastating, particularly for users relying on this device for security and tracking purposes. Immediate action is required! Update the device firmware to the latest version provided by the manufacturer, and review your device settings to ensure proper security measures are applied. Additionally, consider switching to devices that utilize authenticated command systems. You've got this! By taking these steps, you're well on your way to keeping your devices secure. 🛡️