CVE-2024-54512

The issue was addressed by removing the relevant flags

Critical · published January 27, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

🔥 A system binary can fingerprint your Apple Account, exposing a surprising vulnerability in recent iOS versions! Think of it like a sneaky photographer taking your picture without permission at a crowded event. This vulnerability lets a malicious actor match your unique profile despite the crowds, giving them a way to track you down. An attacker could potentially build a profile of your account, leading to unauthorized access or even identity theft. With the CVSS score hitting 9.1, this is not just a minor oversight—it's a critical issue that could unravel the privacy and security of your device!

Put simply

Think of it like a sneaky photographer taking your picture without permission at a crowded event. This vulnerability lets a malicious actor match your unique profile despite the crowds, giving them a way to track you down. This vulnerability stems from specific flags that were improperly configured, allowing a system binary to gather sensitive information related to Apple Accounts. Removing these flags is essential to prevent unauthorized access.

What to do

An attacker could potentially build a profile of your account, leading to unauthorized access or even identity theft. With the CVSS score hitting 9.1, this is not just a minor oversight—it's a critical issue that could unravel the privacy and security of your device! Update to iOS 18.2, iPadOS 18.2, or watchOS 11.2 as soon as possible to block this exploit. Regularly check for updates to ensure your devices are protected against such vulnerabilities. 🛡️ You've got this! Apply the updates and rest easy knowing you're keeping your Apple Account secure! ✨

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00416 · 34.8th percentile
Published
2025-01-27T21:46Z
EPSS history
Timeline
  • 27 JAN 21:46Z
    The issue was addressed by removing the relevant flags
    cvelistv5