Dan Dahlberg

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.

The issue allows SMS-based GPS commands to be executed by the MiCODUS MV720 GPS tracker without requiring authentication.

The main web server of the MiCODUS MV720 GPS tracker has a reflected cross-site scripting issue. This could allow an attacker to gain control by tricking a user into making a request.

The main web server of the MiCODUS MV720 GPS tracker has an authenticated insecure direct object references issue. This issue is related to an endpoint and the POST parameter `Device ID`, which accepts arbitrary device IDs.

The main web server of the MiCODUS MV720 GPS tracker has an authenticated insecure direct object reference issue. This issue is related to the endpoint and parameter `device IDs`, which accept arbitrary `device IDs` without further verification.

A privileged binary in Android devices with code from Ragentek performs over-the-air update checks and hides its execution, resembling a rootkit. The binary, located at /system/bin/debugs, runs with root privileges and communicates over an unencrypted channel with three hosts via HTTP. Server responses can execute arbitrary commands as root, install applications, or update configurations. For example, the binary sends requests like "POST /pagt/agent?data={`name`:`c regist`,`details`: {...}}" to the server, and the server responds with commands, such as "touch /tmp/test".