{"uuid": "7c49ea46-8d29-454d-9632-13db59697038", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2141", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.409119Z"}