#VU26433 Permissions, Privileges, and Access Controls in watchOS - CVE-2020-3917
Published: March 27, 2020 / Updated: March 27, 2020
Vulnerability identifier: #VU26433
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-3917
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
watchOS
watchOS
Software vendor:
Apple Inc.
Apple Inc.
Description
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to a security restriction bypass. A remote attacker can trick a victim to install a malicious application, cause the application to be able to use an SSH client provided by private frameworks and gain access to sensitive information on the target system.
Remediation
Install updates from vendor's website.