PT-2023-6519 · Apple · Watchos

Serkan · Publicado 2023-09-26 · Atualizado 2023-10-12 · CVE-2023-40418

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions watchOS versions prior to 10

Description An authentication issue was addressed with improved state management. The issue is related to the Passcode component of the watchOS operating system and is associated with deficiencies in the authentication procedure. This could potentially allow an attacker to compromise the integrity of protected information. The issue may cause an Apple Watch Ultra to not lock when using the Depth app.

Recommendations For watchOS versions prior to 10, update to watchOS 10 to resolve the issue. As a temporary workaround, consider avoiding the use of the Depth app on an Apple Watch Ultra until the update is applied.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2023-07266

CVE-2023-40418

Produtos afetados

Watchos

Referências · 8

• https://support.apple.com/kb/HT213937 · Nota
• https://support.apple.com/en-us/HT213937 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40418 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-40418 · Aviso do Fabricante
• https://vuldb.com/?id.240372 · Nota
• https://twitter.com/CVEnew/status/1706767471422689650 · Publicação no Twitter
• http://seclists.org/fulldisclosure/2023/Oct/9 · Nota
• https://bdu.fstec.ru/vul/2023-07266 · Nota de Segurança