VULNERABILITY INTELLIGENCE

CVE-2022-33944

CVSS score6.5 MEDIUM

EPSS probability0.99%

CISA KEVNot currently listed

Published2022-07-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.

Weakness classification

CWE-639: Authorization Bypass Through User-Controlled Key

Primary references

ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource