CVE-2022-2107 is a critical hard-coded-credentials flaw (CWE-798) in the MiCODUS MV720, a GPS vehicle tracker fitted to cars, trucks and other fleet vehicles worldwide: its API server accepts a fixed master password that lets an attacker send SMS commands to the tracker as if they came from the device owner's own phone number, including commands that cut the vehicle's fuel supply, and NVD has published its own Primary CVSS v3.1 score of 9.8 (critical) for the flaw.
Vulnerability summary
9.8
Critical
1.3%
EPSS score (FIRST)
No
CISA KEV catalog
2022-07-20
Published
Vulnerability ID: CVE-2022-2107 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| MiCODUS MV720 GPS vehicle tracker | — | All versions, per NVD and CISA; MiCODUS had not released a hardware or firmware fix as of the CISA advisory, so CISA's mitigations (restricting SMS/network access, monitoring for unauthorized commands) remain the primary countermeasure |
What does this mean for affected devices?
CVE-2022-2107 (CWE-798, use of hard-coded credentials) affects the MiCODUS MV720, a compact GPS tracker that is wired into a vehicle's electrical and, on many installations, fuel-relay circuits for real-time location tracking and remote immobilization by fleet operators. NVD's description states: "The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner's mobile number" (NVD).
NVD lists the CVE's status as "Modified" with its own Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — matching the Secondary score CISA's ICS-CERT separately submitted, so both agree on severity (NVD).
CISA's advisory ICSA-22-200-01 bundles this flaw with four companion MV720 vulnerabilities disclosed the same day — CVE-2022-2141 (unauthenticated SMS command execution), CVE-2022-2199 (reflected XSS), CVE-2022-34150 (authenticated IDOR on device parameters) and CVE-2022-33944 (authenticated IDOR on device IDs) — and credits the find to Pedro Umbelino, Dan Dahlberg and Jacob Olcott of BitSight. The advisory states: "Successful exploitation of these vulnerabilities could allow an attacker control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands, and the disarming of various features" (CISA ICS Advisory ICSA-22-200-01).
CISA places the device in the Transportation Systems, Government Facilities, Financial Services and Critical Manufacturing sectors with worldwide deployment — reflecting that BitSight's research estimated over 1.5 million MV720 units in active use for consumer and commercial fleet tracking at the time of disclosure (CISA ICS Advisory ICSA-22-200-01).
MiCODUS did not ship a firmware or hardware fix for the hard-coded password at the time of CISA's advisory; CISA's recommended mitigations are the operational countermeasures available in the interim: minimize network exposure for the tracker's backend infrastructure, place remote-management systems behind firewalls isolated from business networks, and use VPNs for any required remote access rather than exposing management interfaces directly (CISA ICS Advisory ICSA-22-200-01).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01345 (71.6th percentile) as of 2026-11-07 — a critical, publicly disclosed fleet-tracker flaw with a confirmed NVD score but no confirmed in-the-wild mass exploitation reported (CISA KEV, FIRST EPSS).
Fleet operators and consumers running a MiCODUS MV720 should treat the device's SMS-command channel and backend API as untrusted given the absence of a vendor fix, restrict which numbers/systems can reach the tracker, and monitor for unexpected fuel-cutoff or configuration-change commands.
Evidence
- The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password, allowing an attacker to send SMS commands to the tracker as if from the owner's mobile number. — NVD
- NVD status 'Modified'; NVD Primary CVSS v3.1 base score 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching CISA's Secondary submission. — NVD
- Advisory ICSA-22-200-01 bundles CVE-2022-2107 with CVE-2022-2141, CVE-2022-2199, CVE-2022-34150 and CVE-2022-33944; reported by Pedro Umbelino, Dan Dahlberg and Jacob Olcott of BitSight; 'Successful exploitation ... could allow an attacker control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands, and the disarming of various features.' Sectors: Transportation Systems, Government Facilities, Financial Services, Critical Manufacturing; worldwide deployment. — CISA ICS Advisory ICSA-22-200-01
- No vendor firmware/hardware fix for the hard-coded password was available at the time of the advisory; CISA recommends minimizing network exposure, isolating remote-management systems behind firewalls, and using VPNs for remote access. — CISA ICS Advisory ICSA-22-200-01
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01345 (71.6th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can an attacker actually do if they exploit CVE-2022-2107?
By authenticating to the MiCODUS MV720's backend API with the hard-coded master password, an attacker can send SMS commands to the tracker as if they came from the vehicle owner's own registered phone number — gaining access to the vehicle's location and routes and the ability to issue fuel-cutoff commands or disarm other features (per NVD; per CISA ICS Advisory ICSA-22-200-01).
Does NVD have its own confirmed severity score for this CVE, or is it only a vendor estimate?
NVD lists its own Primary CVSS v3.1 base score of 9.8 (critical) for CVE-2022-2107, matching the Secondary score CISA's ICS-CERT separately submitted — both agree on the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (per NVD).
Is there a firmware fix for the MiCODUS MV720 hard-coded password?
CISA's advisory ICSA-22-200-01 does not list a vendor firmware or hardware fix for the hard-coded master password; the recommended mitigations are operational — minimizing network exposure for tracker backend infrastructure, isolating remote-management systems behind firewalls, and using VPNs instead of direct remote access (per CISA ICS Advisory ICSA-22-200-01).