{"vulnerability": "cve-2022-3415", "sightings": [{"uuid": "9632b88d-10d0-4337-9edf-ec3e95622ca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34159", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ldpgcepwel2a", "content": "", "creation_timestamp": "2024-12-20T03:15:57.601608Z"}, {"uuid": "b903f23b-bdd9-48a7-956c-74dbd3953b3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34151", "type": "seen", "source": "https://t.me/itsec_news/3280", "content": "\u200b\u26a1\ufe0f\u041d\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b: Omron \u0431\u043e\u0440\u0435\u0442\u0441\u044f \u0441\u043e \u0441\u043b\u043e\u0436\u043d\u044b\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e.\n\n\ud83d\udcac\u042f\u043f\u043e\u043d\u0441\u043a\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Omron \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u0443\u0435\u043c\u043e\u043c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 (\u041f\u041b\u041a, PLC) \u0438 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u043e\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Dragos \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u043e\u0436\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u043e\u0435 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 , \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u044b Omron \u0441\u0435\u0440\u0438\u0439 NJ \u0438 NX. Dragos \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0434\u043d\u0430 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u2013 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 CVE-2022-34151, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0436\u0451\u0441\u0442\u043a\u043e \u0437\u0430\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a PLC Omron \u0438 \u0441\u0442\u0430\u043b\u0430 \u0446\u0435\u043b\u044c\u044e \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f (ICS) \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Pipedream (Incontroller).\n\nDragos \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Pipedream, BadOmen, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b CVE-2022-34151 \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 Omron NX/NJ. BadOmen \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0438 \u0432\u044b\u0437\u043e\u0432\u0430 \u0441\u0431\u043e\u0435\u0432 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u0445.\n\n\u0412\u043e \u0432\u0440\u0435\u043c\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e BadOmen Dragos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Omron. CISA \u0438 Omron \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438, \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u0443\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u0412 Dragos \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0438\u0437\u0434\u0430\u043d\u0438\u044e SecurityWeek, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e, \u0438 \u043d\u0435\u0442 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. CISA \u0438 Omron \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0442\u0440\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438.\n\n\u041e\u0434\u043d\u0430 \u0438\u0437 \u043d\u0438\u0445 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2022-45790 (CVSS: 7.5) \u0432 PLC Omron \u0441\u0435\u0440\u0438\u0439 CJ/CS/CP, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b FINS, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0430\u043c \u043c\u0435\u0442\u043e\u0434\u043e\u043c \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 (\u0431\u0440\u0443\u0442\u0444\u043e\u0440\u0441).\n\u0414\u0432\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438 Omron: CVE-2022-45793 (CVSS: 5.5) \u0438 CVE-2018-1002205 (CVSS: 5.5).\n\u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0421\u0428\u0410 (CISA) \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e \u0432\u043e\u0441\u0435\u043c\u044c \u043d\u043e\u0432\u044b\u0445 \u043f\u0443\u043d\u043a\u0442\u043e\u0432 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 . \u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u043d\u044f\u0442\u043e \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0421\u0428\u0410 (DHS) \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u043e \u0443\u043f\u0440\u043e\u0441\u0442\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0442\u0447\u0451\u0442\u043d\u043e\u0441\u0442\u0438 \u043e \u043a\u0438\u0431\u0435\u0440\u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u0443\u0442\u0451\u043c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u043f\u043e\u0440\u0442\u0430\u043b\u0430 \u0434\u043b\u044f \u0442\u0430\u043a\u0438\u0445 \u043e\u0442\u0447\u0451\u0442\u043e\u0432.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2023-09-23T17:42:16.000000Z"}, {"uuid": "5cbe743a-f7a6-4fc5-8b1f-6fc38ec3237f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34159", "type": "seen", "source": "https://t.me/cvedetector/13397", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2022-34159 - Huawei Printers Unvalidated Input Exception\", \n  \"Content\": \"CVE ID : CVE-2022-34159 \nPublished : Dec. 20, 2024, 3:15 a.m. | 42\u00a0minutes ago \nDescription : Huawei printers have an input verification vulnerability. Successful exploitation of this vulnerability may cause device service exceptions. (Vulnerability ID: HWPSIRT-2022-80078)  \n  \nThis vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-34159. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"20 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-20T05:02:11.000000Z"}, {"uuid": "705140ec-8aea-4b35-97d9-17fcb5ef52a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34158", "type": "seen", "source": "https://t.me/arpsyndicate/3170", "content": "#ExploitObserverAlert\n\nCVE-2022-34158\n\nDESCRIPTION: Exploit Observer has 2 entries in 2 file formats related to CVE-2022-34158. A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.\n\nFIRST-EPSS: 0.003930000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2024-01-28T02:43:15.000000Z"}, {"uuid": "007d92bb-41a1-4717-aca8-0dcd9a07acd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/true_secator/3196", "content": "BitSight \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0445 GPS-\u0442\u0440\u0435\u043a\u0435\u0440\u0430\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f Micodus.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0435\u0449\u0435 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0438 \u0441 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u043e\u0436\u0438\u0434\u0430\u0435\u0442 \u043e\u0442\u0432\u0435\u0442\u0430 \u043e\u0442 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0447\u0435\u043c \u0431\u0430\u0433\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c\u0438.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-2107, CVE-2022-2141, CVE-2022-2199, CVE-2022-34150 \u0438 CVE-2022-33944 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 GPS-\u0442\u0440\u0435\u043a\u0435\u0440 Micodus MV720 (\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432 20 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432), \u043d\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u0447\u0442\u043e \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b Micodus \u0442\u0430\u043a\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n\u041f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u0435\u0432\u0430\u0439\u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0437\u0430\u0434\u0430\u0447\u0438 GPS-\u0441\u043b\u0435\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043a\u0440\u0430\u0436\u0438, \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0442\u043e\u043f\u043b\u0438\u0432\u043e\u043f\u043e\u0434\u0430\u0447\u0438 \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c SMS, \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u043e\u0435 \u0438\u043b\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.\n\n\u041d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u043c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e \u0431\u043e\u043b\u0435\u0435 1,5 \u043c\u043b\u043d. \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0432 169 \u0441\u0442\u0440\u0430\u043d\u0430\u0445 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0433\u043e\u0441\u0441\u0435\u043a\u0442\u043e\u0440\u0435, \u0432\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u043b\u0430\u0445, \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u0445, \u0430\u044d\u0440\u043e\u043a\u043e\u0441\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439, \u043c\u0430\u0448\u0438\u043d\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439, \u0441\u0443\u0434\u043e\u0445\u043e\u0434\u043d\u043e\u0439, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u0442\u0440\u0430\u0441\u043b\u044f\u0445.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u043e\u0439 BitSight \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 2,3 \u043c\u043b\u043d. \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 Micodus, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 90 000 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u043f\u043e \u043f\u043e\u0440\u0442\u0443 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0435\u0435 \u0447\u0438\u0441\u043b\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0430 \u0442\u0430\u043a\u0438\u0435 \u0441\u0442\u0440\u0430\u043d\u044b, \u043a\u0430\u043a \u0420\u043e\u0441\u0441\u0438\u044f, \u041c\u0435\u043a\u0441\u0438\u043a\u0430, \u0427\u0438\u043b\u0438, \u0411\u0440\u0430\u0437\u0438\u043b\u0438\u044f, \u0418\u0441\u043f\u0430\u043d\u0438\u044f, \u041f\u043e\u043b\u044c\u0448\u0430, \u0423\u043a\u0440\u0430\u0438\u043d\u0430, \u042e\u0436\u043d\u0430\u044f \u0410\u0444\u0440\u0438\u043a\u0430 \u0438 \u041c\u0430\u0440\u043e\u043a\u043a\u043e.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432 \u0438\u0445 \u0447\u0438\u0441\u043b\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u044b: \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u043b\u044b \u0432 \u042e\u0436\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u0435, \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0417\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u043c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u0438 \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u043c \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438, \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, XSS \u0438 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0440\u044f\u043c\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u043e\u0439 IDOR.\u00a0\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0432\u0435\u043a\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a: MitM, \u043e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u0440\u0435\u043a\u0435\u0440\u0430 \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 API.\n\n\u041f\u0440\u0438 \u043b\u044e\u0431\u043e\u043c \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 GPS-\u0442\u0440\u0435\u043a\u0435\u0440\u043e\u043c - \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 BitSight. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u0430\u0442\u0430\u043a\u0438: \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u043c\u0430\u0448\u0438\u043d\u0443 \u0438\u043b\u0438 \u0432\u0435\u0441\u044c \u0430\u0432\u0442\u043e\u043f\u0430\u0440\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043f\u043e\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0432 \u0432\u044b\u043a\u0443\u043f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0430\u0432\u0442\u043e \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f.\n\nBitSight \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u00a0\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432\u0441\u0435\u0445 \u043e\u0448\u0438\u0431\u043e\u043a, \u043f\u043e\u0441\u043e\u0432\u0435\u0442\u043e\u0432\u0430\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c Micodus \u043f\u0440\u0435\u043a\u0440\u0430\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0442\u0440\u0435\u043a\u0435\u0440\u0430 \u0434\u043e \u0442\u0435\u0445 \u043f\u043e\u0440, \u043f\u043e\u043a\u0430 \u043d\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\u00a0\u041e\u0431\u0445\u043e\u0434\u043d\u044b\u0435 \u043f\u0443\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b.", "creation_timestamp": "2022-07-20T14:05:04.000000Z"}, {"uuid": "c2d8b019-99b9-40a9-aa93-754b2c7fe5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34155", "type": "seen", "source": "https://t.me/cibsecurity/66911", "content": "\u203c CVE-2022-34155 \u203c\n\nImproper Authentication vulnerability in miniOrange OAuth Single Sign On \u00e2\u20ac\u201c SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On \u00e2\u20ac\u201c SSO (OAuth Client): from n/a through 6.23.3.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-18T18:32:46.000000Z"}, {"uuid": "aa7bb84c-07f1-4f4d-905d-5802feda8a8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/cibsecurity/46694", "content": "\u203c CVE-2022-34150 \u203c\n\nThe main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-20T20:12:19.000000Z"}, {"uuid": "c0e7244b-7d03-49bf-a119-1d38a43108e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34158", "type": "seen", "source": "https://t.me/cibsecurity/47539", "content": "\u203c CVE-2022-34158 \u203c\n\nA carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-04T12:19:30.000000Z"}, {"uuid": "505f3d13-78b3-44be-9aae-d84e95da23f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34151", "type": "seen", "source": "https://t.me/cibsecurity/45555", "content": "\u203c CVE-2022-34151 \u203c\n\nUse of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-04T07:12:09.000000Z"}, {"uuid": "7d290098-72f6-448e-9f47-6ff450f0d76a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.362574Z"}, {"uuid": "0d1d3383-04ac-496c-8376-6ec7ec3f243a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34150", "type": "seen", "source": "https://t.me/hacking_Attack/62357", "content": "Black Hat Ethical Hacking\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles\n\nZero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehiclesPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA raft of zero-day\u00a0flaws found in a popular automotive GPS tracking device \u201ccould have disastrous and even life-threatening implications\u201d, security researchers warn.\n\nSix as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.\n\nSuccessful abuse of the bugs could see attackers \u201ccut fuel to an entire fleet of commercial or emergency vehicles\u201d, use GPS data \u201cto monitor and abruptly stop vehicles on dangerous highways\u201d, or \u201ctrack individuals or demand ransom payments to return disabled vehicles to working condition\u201d, according to research\u00a0(PDF) from BitSight.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Huge attack surfaceAccording to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.\n\nAlarmingly, BitSight said Umbelino also uncovered security issues associated with the firm\u2019s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS\u2019 own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.\n\nWith security patches yet to materialize, BitSight has urged users to \u201cimmediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available\u201d.\n\nA security advisory\u00a0from the US Cybersecurity and Infrastructure Security Agency (CISA) said that \u201cno known public exploits specifically target these vulnerabilities\u201d in the MV720 GPS tracker.\nTrending: How Misconfigurations in Linux can leave you vulnerable to Attackers Trending: Recon Tool: WayMore Authentication issuesTwo critical authentication issues in the API server, both notching a CVSS score of 9.8, enable \u201can attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner\u2019s mobile number\u201d.\n\nOne bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.\n\nThe devices and the mobile interface are preconfigured with the default password \u2018123456\u2019, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. \u201cThere is no mandatory rule to change the password nor is there any claiming process\u201d, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.\n\nWith the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.\n\nA high severity (CVSS 7.5) reflected cross-site scripting\u00a0(XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to \u201cfully compromise the device\u201d.\n\nThe main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.074370Z"}]}