CVE-2022-2107

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-21085.3The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due CVE-2022-21118.8Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-21128.8Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-211229.8The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As t CVE-2022-211235.5Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable informati CVE-2022-211247.8Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause i CVE-2022-211255.5Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable info CVE-2022-211267.8The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due CVE-2022-211275.5Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially CVE-2022-211287.8Insufficient control flow management in the Intel(R) Advisor software before version 7.6.0.37 may allow an authenticated user to potentially CVE-2022-211299.8Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.expor CVE-2022-21135.4Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.