CVE-2022-33944CWE-639

ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

Medium · published July 20, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
62.3
In the wild
Unconfirmed
What it is

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00994 · 62.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2022-07-20T15:24Z
EPSS history
Timeline
  • 20 JUL 15:24Z
    ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key
    cvelistv5