#VU85363 Improper authentication in Apple iOS and iPadOS - CVE-2022-48618
Published: January 15, 2024
Vulnerability identifier: #VU85363
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2022-48618
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Apple iOS
iPadOS
Apple iOS
iPadOS
Software vendor:
Apple Inc.
Apple Inc.
Description
The vulnerability allows a local application to compromise the affected system.
The vulnerability exists due to an error within the OS kernel. A local application or user with arbitrary read and write capability can bypass Pointer Authentication and compromise the affected system.
Note, the vulnerability is being actively exploited in the wild against versions of iOS released before iOS 15.7.1.
Remediation
Install updates from vendor's website.