CVE-2022-34150CWE-639

ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

High · published July 20, 2022

CVSS v3.1
7.1
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00716 · 53.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2022-07-20T15:24Z
EPSS history
Timeline
  • 20 JUL 15:24Z
    ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key
    cvelistv5