Permissions, Privileges, and Access Controls in watchOS - CVE-2020-3917
Published: March 27, 2020 / Updated: March 27, 2020
Vulnerability identifier: #VU26433
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-3917
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Apple Inc.
Affected software:
watchOS
watchOS
Detailed vulnerability description
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to a security restriction bypass. A remote attacker can trick a victim to install a malicious application, cause the application to be able to use an SSH client provided by private frameworks and gain access to sensitive information on the target system.
How to mitigate CVE-2020-3917
Install updates from vendor's website.