CVE-2024-44171: Medium severity Apple WatchOS vulnerability

Q: What is the severity of CVE-2024-44171?

CVE-2024-44171 is considered a high severity vulnerability that could allow an attacker with physical access to control nearby devices.

Q: How do I fix CVE-2024-44171?

To fix CVE-2024-44171, update to iOS 17.7, iPadOS 17.7, iOS 18, iPadOS 18, or watchOS 11.

Q: What devices are affected by CVE-2024-44171?

CVE-2024-44171 affects iPadOS versions prior to 17.7, iPhone OS versions prior to 17.7, and watchOS versions prior to 11.0.

Q: Can CVE-2024-44171 be exploited remotely?

No, CVE-2024-44171 requires physical access to the locked device to exploit.

Q: What does CVE-2024-44171 involve?

CVE-2024-44171 involves insufficient state management that may allow control of nearby devices through accessibility features.

Published Sep 16, 2024

Updated

Accessibility. This issue was addressed through improved state management.

Other sources

Accessibility. This issue was addressed with improved data protection.

— Apple

This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, watchOS 11. An attacker with physical access to a locked device may be able to Control Nearby Devices via accessibility features.

— MITRE

Credit

Jake Derouin (jakederouin.com), Denis Tokarev@@illusionofcha0s, Junsung Lee, dw0r(ZeroPointer Lab working with Trend Micro Zero Day Initiative), an anonymous researcher, Antonio Zekić, Alexander Heinrich, SEEMOO, DistriNet, KU Leuven@@vanhoefm, TU Darmstadt@@Sn0wfreeze, Mathy Vanhoef, Kirin@@Pwnrin, Jeff Johnson (underpassapp.com), OSS-Fuzz(Google Project Zero), Ned Williamson(Google Project Zero), Olivier Levon, Narendra Bhati(Cyber Security at Suma Soft Pvt), Manager(Cyber Security at Suma Soft Pvt), Pune (India), 냥냥, K宝, LFY@@secsys, Smi1e, yulige, Cristian Dinca (icmd.tech), Rodolphe BRUNETTI@@eisw0lf, Narendra Bhati(Cyber Security At Suma Soft Pvt), Manager(Cyber Security At Suma Soft Pvt), Tashita Software Security, Ron Masas, Chloe Surett, Abhay Kailasia@@abhay_kailasia(Lakshmi Narain College of Technology Bhopal India), Holger Fuhrmannek, Tuan D. Hoang, Snoolie Keffaber@@0xilis, Daniele Antonioli, Csaba Fitzl@@theevilbit(Kandji), @@08Tc3wBB(Jamf), Andrew Lytvynov, CVE-2023-5841, ajajfxhj, Bistrit Dahal, Joshua Keller, Lukas, Kenneth Chew, Anamika Adhikari, Wojciech Regula(SecuRing), Om Kothawade(Zaprico Digital), Omar A. Alanis(the UNTHSC College of Pharmacy), Matej Moravec@@MacejkoMoravec, Chi Yuan Chang(ZUSO ART), taikosoup, Srijan Poudel, Ron Masas(BreakPoint), Bohdan Stasiuk@@Bohdan_Stasiuk, Justin Cohen, Tim Michaud@@TimGMichaud(Moveworks), Preet Dsouza (Fleming College, Computer Security & Investigations Program), Domien Schepers, Kirin@@Pwnrin(NorthSea), luckyu@@uuulucky(NorthSea), Mickey Jin@@patch1t

Affected Software

8 affected componentsFixes available

Apple WatchOS<11

Apple iOS<18

Apple iPadOS<18

Apple iOS<17.7

17.7

Apple iPadOS<17.7

17.7

Apple iPadOS<17.7

Apple iPhone OS<17.7

Apple WatchOS<11.0

Event History

Sep 16, 2024

CVE Published

via MITRE·11:22 PM

Data Sourced

via MITRE·11:22 PM

DescriptionWeakness

Sep 17, 2024

Data Sourced

via NVD·12:15 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2024-44171?

CVE-2024-44171 is considered a high severity vulnerability that could allow an attacker with physical access to control nearby devices.

How do I fix CVE-2024-44171?

To fix CVE-2024-44171, update to iOS 17.7, iPadOS 17.7, iOS 18, iPadOS 18, or watchOS 11.

What devices are affected by CVE-2024-44171?

CVE-2024-44171 affects iPadOS versions prior to 17.7, iPhone OS versions prior to 17.7, and watchOS versions prior to 11.0.

Can CVE-2024-44171 be exploited remotely?