SB20220720120 - Multiple vulnerabilities in MiCODUS MV720 GPS tracker

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Use of hard-coded credentials (CVE-ID: CVE-2022-2107)

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code in the API server. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Improper Authentication (CVE-ID: CVE-2022-2141)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can bypass authentication process and execute arbitrary SMS-based GPS commands.

3) Cross-site scripting (CVE-ID: CVE-2022-2199)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the main web server. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

4) Authorization bypass through user-controlled key (CVE-ID: CVE-2022-34150)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the main web server has an authenticated insecure direct object reference issue on endpoint and parameter device IDs. A remote user can cause the target application accepts arbitrary device IDs without further verification

5) Authorization bypass through user-controlled key (CVE-ID: CVE-2022-33944)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the main web server has an authenticated insecure direct object references issue on endpoint and POST parameter "Device ID". A remote user can cause the target application accepts arbitrary device IDs.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://ics-cert.us-cert.gov/advisories/icsa-22-200-01