PT-2025-7272 · Apple · Device

Axi0Mx · Published 2025-02-21 · Updated 2025-07-29 · CVE-2019-8900

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apple devices (affected versions not specified)

Description A security issue in the SecureROM of certain Apple devices allows an unauthenticated local attacker to execute arbitrary code on the device upon booting. This requires physical access to the device, which must be connected to a computer and put into Device Firmware Update (DFU) mode during boot. The exploit is not persistent, as rebooting the device overrides any changes made during the exploited session. Additionally, without the device's unlock PIN or fingerprint, an attacker cannot access information protected by Apple's Secure Enclave or Touch ID features.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-8900

Affected Products

Device

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-8900 · Security Note
• https://kb.cert.org/vuls/id/941987 · Note
• https://t.me/cvenotify/112150 · Telegram Post
• https://t.me/cveNotify/130137 · Telegram Post
• https://t.me/cvedetector/18697 · Telegram Post