PT-2024-1415 · Apple · Magic Keyboard

Marc Newlin · Published 2024-01-11 · Updated 2026-03-13 · CVE-2024-0230

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magic Keyboard versions prior to 2.0.6

Description A session management issue was addressed with improved checks. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic. The issue is related to the management of user sessions and can be exploited to gain unauthorized access to Bluetooth traffic.

Recommendations For Magic Keyboard versions prior to 2.0.6, update to Magic Keyboard Firmware Update 2.0.6 to fix the issue. As a temporary workaround, consider restricting physical access to the accessory to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1018

Related Identifiers

BDU:2024-00888

CVE-2024-0230

Affected Products

Magic Keyboard

References · 31

• 🔥 https://github.com/keldnorman/cve-2024-0230-blue · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-0230 · Security Note
• https://bdu.fstec.ru/vul/2024-00888 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0230 · Vendor Advisory
• https://github.com/pentestfunctions/BlueDucky · Note
• https://github.com/marcnewlin/hi_my_name_is_keyboard · Note
• https://twitter.com/VulmonFeeds/status/1745474894974857460 · Twitter Post
• https://twitter.com/TheHackForce/status/1750241838609359158 · Twitter Post
• https://t.me/cvenotify/67338 · Telegram Post
• https://twitter.com/minacrissDev_/status/1963767259073061207 · Twitter Post
• https://support.apple.com/en-us/120303 · Note
• https://t.me/purple_medved/181 · Telegram Post
• https://t.me/cybersecuritytechnologies/10237 · Telegram Post
• https://twitter.com/XynikIT/status/1745448759465832624 · Twitter Post
• https://t.me/cvenotify/68059 · Telegram Post