Vulnerability · Published Feb 24, 2022 · Assigned by certcc

CVE-2022-0732

High 7.5

In plain English

A high-severity improper access control in Copy9 from 1Byte. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.5%top 15.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

Affected products (as reported)

Vendor	Product	Versions
1Byte	Copy9	All
1Byte	FoneTracker	All
1Byte	iSpyoo	All
1Byte	GuestSpy	All
1Byte	TheSpyApp	All
1Byte	ExactSpy	All
1Byte	SecondClone	All
1Byte	The Truth Spy	All
1Byte	MxSpy	All

Weakness: CWE-284

References

VU#229438 third-party-advisory, x_refsource_CERT-VN
https://cwe.mitre.org/data/definitions/284.html x_refsource_MISC
https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/ x_refsource_CONFIRM
https://kb.cert.org/vuls/id/229438 third-party-advisory, x_refsource_CERT-VN