Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2022-2107

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.

CVSS 9.8 · CriticalBuzz score 25.6

Buzz score

Why this CVE is surfacing

Buzz score total 25.6

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 16.1 · diversity 9.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
16.1
4 evidence mentions in the snapshot
Diversity score
9.5
4 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
4 source links · newest first
  • Vulnerabilities in GPS tracker could have “life-threatening” implicationsMalwarebytes Labs

    Researchers at BitSight have discovered six vulnerabilities in the MiCODUS MV720 GPS tracker, a popular vehicle tracking device. The vulnerabilities are severe…

    newswww.malwarebytes.comJul 20, 2022, 5:00 PM
  • Million of vehicles can be attacked via MiCODUS MV720 GPS TrackersSecurity Affairs

    Multiple flaws in MiCODUS MV720 Global Positioning System (GPS) trackers shipped with over 1.5 million vehicles can allow hackers to remotely hack them. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an advisory to warn of multiple security vulnerabilities in MiCODUS MV720 Global Positioning System (GPS) trackers which are used by over 1.5 million vehicles. An attacker […]

    newssecurityaffairs.comJul 20, 2022, 2:53 PM
  • GPS trackers used for vehicle fleet management can be hijacked by hackersCSO Online

    Hackers can exploit vulnerabilities in a popular GPS tracking device used around the world for vehicle fleet management across many industry sectors. The tracker, made by a Chinese company called MiCODUS, is widely available to purchase from online retailers and has anti-theft, fuel cut off, remote control, and geofencing capabilities. “​​The exploitation of these vulnerabilities […]

    newswww.csoonline.comJul 19, 2022, 3:28 PM
  • Unpatched Micodus GPS Tracker Vulnerabilities Allow Hackers to Remotely Disable CarsSecurityWeek

    Widely used vehicle GPS trackers from Micodus are affected by critical vulnerabilities that can be exploited by hackers to stalk people and remotely disable cars, according to cybersecurity company BitSight.

    newswww.securityweek.comJul 19, 2022, 3:03 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2022-34150

    The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary devi…

    CVSS 7.1 · High
    4 mentions
  • CVE-2022-33944

    The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitr…

    CVSS 6.5 · Medium
    4 mentions
  • CVE-2022-2199

    The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a requ…

    CVSS 7.5 · High
    4 mentions
  • CVE-2022-2141

    SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.

    CVSS 9.8 · Critical
    4 mentions
  • CVE-2026-8983

    Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker ca…

    CVSS 10.0 · Critical
    1 mention
  • CVE-2026-8982

    Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-s…

    CVSS 10.0 · Critical
    1 mention