https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-34150.htmlhttps://patchthecve.com/cve/CVE-2022-34150.htmlWed, 17 Jun 2026 04:49:48 +0000HIGH 7.1: The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.https://patchthecve.com/cve/CVE-2022-33944.htmlhttps://patchthecve.com/cve/CVE-2022-33944.htmlWed, 17 Jun 2026 04:49:31 +0000MEDIUM 6.5: The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.https://patchthecve.com/cve/CVE-2022-2199.htmlhttps://patchthecve.com/cve/CVE-2022-2199.htmlWed, 17 Jun 2026 04:41:29 +0000HIGH 7.5: The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.https://patchthecve.com/cve/CVE-2022-2141.htmlhttps://patchthecve.com/cve/CVE-2022-2141.htmlWed, 17 Jun 2026 04:41:23 +0000CRITICAL 9.8: SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.https://patchthecve.com/cve/CVE-2022-2107.htmlhttps://patchthecve.com/cve/CVE-2022-2107.htmlWed, 17 Jun 2026 04:41:18 +0000CRITICAL 9.8: The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.