PT-2024-36358 · Apple · Visionos+4

Mysk_Co + 2 · Published 2024-12-11 · Updated 2026-03-27 · CVE-2024-54492

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macOS versions prior to 15.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 visionOS versions prior to 2.2 iPadOS version 17.7.3

Description The issue was addressed by utilizing HTTPS when transmitting information over the network. An attacker with a privileged position on the network could potentially alter network traffic. The Passwords app was using unencrypted HTTP to download icons for password entries, posing a potential security risk.

Recommendations Update macOS to version 15.2. Update iOS to version 18.2. Update iPadOS to version 18.2. Update visionOS to version 2.2. Update iPadOS to version 17.7.3.

Fix

Related Identifiers

CVE-2024-54492

Affected Products

Apple Macos

Ios

Ipados

Macos Sequoia

Visionos

References · 17

• https://support.apple.com/en-us/121839 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-54492 · Vendor Advisory
• https://support.apple.com/en-us/121838 · Vendor Advisory
• https://support.apple.com/en-us/121845 · Vendor Advisory
• https://support.apple.com/en-us/121837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54492 · Security Note
• https://twitter.com/CVEnew/status/1867286553078501684 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54492 · Note
• https://reddit.com/r/k12cybersecurity/comments/1hcx6t8/msisac_cybersecurity_advisory_multiple · Reddit Post
• http://seclists.org/fulldisclosure/2024/Dec/12 · Note
• https://t.me/latest_high_impact_cve/1641 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Dec/7 · Note
• https://twitter.com/VulmonFeeds/status/1867132399844221163 · Twitter Post
• https://twitter.com/mysk_co/status/2037676552440213939 · Twitter Post
• https://twitter.com/minacris_/status/1924293273725657143 · Twitter Post