What’s Vulnerable › Vulnerabilities

CVE-2022-0732

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-24 · updated 2026-06-17
• Weakness: CWE-284

Description

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

Affected products

• 1Byte Copy9: all versions
• 1Byte ExactSpy: all versions
• 1Byte FoneTracker: all versions
• 1Byte GuestSpy: all versions
• 1Byte iSpyoo: all versions
• 1Byte MxSpy: all versions
• 1Byte SecondClone: all versions
• 1Byte The Truth Spy: all versions
• 1Byte TheSpyApp: all versions

References

• https://cwe.mitre.org/data/definitions/284.html
• https://kb.cert.org/vuls/id/229438
• https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
• https://www.kb.cert.org/vuls/id/229438
• https://cwe.mitre.org/data/definitions/284.html
• https://kb.cert.org/vuls/id/229438
• https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
• https://www.kb.cert.org/vuls/id/229438

Get alerted when CVE-2022-0732 or the next vulnerability affects your stack