The US Cybersecurity Infrastructure Security administration (CISA) and security company BitSight released reports regarding six (6) unpatched security vulnerabilities in the MiCODUS MV720 Global Positioning System (GPS) trackers. This tracker is installed in over 1.5 million vehicles worldwide. Exploitation of these vulnerabilities allows remote threat actors to gain control of the GPS tracker, revealing the exact location of the vehicle. The vulnerabilities also impact “access to a vehicle fuel supply, vehicle control, or allow locational surveillance of vehicles in which the device is installed.” The six (6) flaws are as follows:
-
- CVE-2022-2107: Hardcoded master password on the API server that could allow an unauthorized attacker to gain complete control of the tracker. The severity score is 9.8.
- CVE-2022-2141: Broken authentication scheme that could allow commands to be sent to tracker via SMS to be run with administrator privileges. The severity score is 9.8.
- CVE-2022-2199: Reflected cross-site scripting (XSS) on the main web server which could allow an attack to access user accounts and all information accessible to compromised users. The severity score is 7.5.
- CVE-2022-34150: Insecure direct object reference on the main web server which could allow logged-in users to access the data of any Device ID in the server database. The severity score is 7.1.
- CVE-2022-33944: Insecure direct object reference on the main web server which could allow unauthorized attackers to gain Excel reports about GPS tracker activity. The severity score is 6.5
- No CVE: Weak default password on all MV720 trackers with no rule in place for users to change passwords after initial device set up. The severity score is 8.1.
The MV720 is the basic model produced by MiCODUS and cost $20 retail. Approximately 169 countries currently have MiCODUS trackers employed in organizations with the most users located in Chile, Australia, Mexico, Ukraine, Russia, Morocco, Venezuela, Brazil, Poland, Italy, Indonesia, Uzbekistan, and South Africa. BitSight researchers also discovered evidence that these vulnerabilities could be used to track individuals without their knowledge, disable vehicles, and even pose national security threat – especially considering militaries and law enforcement agencies use the trackers for real-time monitoring. For example, the Ukrainian military uses MiCODUS GPS trackers, allowing Russian hackers to exploit these flaws and use them to track troop movements, supply routes, or patrol routes. There are currently five (5) Proof-of-Concept exploits developed by BitSight to demonstrate how they could be exploited in the wild, and CTIX analysts will provide updates as more become available.