Security readout for executives and security teams
Plain-English summary
A logged-in user of the MiCODUS MV720 GPS tracker web server could query other devices by supplying arbitrary Device IDs. The business impact is unauthorized exposure of GPS tracker data, which may reveal sensitive vehicle, asset, or personnel location information.
Executive priority
Prioritize this where MV720 trackers protect vehicles, assets, logistics, or personnel movements. The issue is not rated critical, but location-data exposure can create operational, privacy, and physical-security risk.
Technical view
CVE-2022-33944 is an authenticated IDOR/CWE-639 in the main MiCODUS MV720 web server. The endpoint accepts a user-controlled Device ID POST parameter without sufficient authorization checks, allowing access to arbitrary device identifiers. CVSS is 6.5, driven by network reachability, low complexity, low privileges, and high confidentiality impact.
Likely exposure
Organizations using MiCODUS MV720 GPS trackers are potentially exposed. The source bundle lists all versions as affected, but does not provide deployment-specific indicators, patch status, or a complete product matrix.
Exploitation context
The bundle does not show CISA KEV listing or other evidence of active exploitation. Exploitation requires authenticated access, but the vulnerable authorization check could expose data for devices outside the user’s account or authorization boundary.
Researcher notes
Evidence supports an authenticated IDOR on a Device ID parameter with confidentiality impact. The bundle does not include exploit details, patch confirmation, or active exploitation evidence. Do not assume unauthenticated exploitation or broader MiCODUS product impact from this record alone.
Mitigation direction
- Review the CISA advisory and MiCODUS guidance for supported remediation.
- Inventory MiCODUS MV720 trackers and associated web accounts.
- Restrict portal/API access to trusted users and networks where feasible.
- Monitor for unusual Device ID access patterns or cross-account data access.
- Avoid treating GPS tracker data as low sensitivity.
Validation and detection
- Confirm whether MiCODUS MV720 trackers are deployed or managed.
- Identify exposed web portals, APIs, and account roles tied to MV720 devices.
- Verify authorization checks prevent access to unrelated Device IDs.
- Review logs for repeated or unexpected Device ID lookups.
- Track vendor or CISA updates for remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-33944 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.