CVE-2022-34534

published 2022-07-19

CVE-2022-34534: Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.

Priority P3 52 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dw	spectrum_server_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /api/moduleInformation↗

other http.favicon.hash:868509217↗

other icon_hash="868509217"↗

• → Unauthenticated HTTP GET request to /api/moduleInformation returns JSON body containing 'name":', 'cloudHost":', and 'remoteAddresses' fields with HTTP 200 and Content-Type application/json — indicates vulnerable DW Spectrum Server instance. ↗
• → Response header must contain 'application/json' and status code must be 200 to confirm successful unauthenticated information disclosure via the moduleInformation API. ↗
• → Fingerprint DW Spectrum Server instances on Shodan using favicon hash 868509217 or FOFA icon_hash to identify exposed targets. ↗

• · Vulnerability is specific to Digital Watchdog DW Spectrum Server version 4.2.0.32842; other versions may not be affected. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200