PT-2023-6519 · Apple · Watchos

Serkan · Published 2023-09-26 · Updated 2023-10-12 · CVE-2023-40418

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions watchOS versions prior to 10

Description An authentication issue was addressed with improved state management. The issue is related to the Passcode component of the watchOS operating system and is associated with deficiencies in the authentication procedure. This could potentially allow an attacker to compromise the integrity of protected information. The issue may cause an Apple Watch Ultra to not lock when using the Depth app.

Recommendations For watchOS versions prior to 10, update to watchOS 10 to resolve the issue. As a temporary workaround, consider avoiding the use of the Depth app on an Apple Watch Ultra until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-07266

CVE-2023-40418

Affected Products

Watchos

References · 8

• https://support.apple.com/en-us/HT213937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40418 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40418 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07266 · Security Note
• https://support.apple.com/kb/HT213937 · Note
• https://vuldb.com/?id.240372 · Note
• https://twitter.com/CVEnew/status/1706767471422689650 · Twitter Post
• http://seclists.org/fulldisclosure/2023/Oct/9 · Note