// For flags

CVE-2019-25071

Apple iOS Siri Self privileges management

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications.

Se ha encontrado una vulnerabilidad en el iPhone de Apple hasta la versión 12.4.1. Ha sido declarada como crítica. Esta vulnerabilidad afecta a Siri. La reproducción de un archivo de audio o vídeo podría iniciar Siri en el mismo dispositivo, lo que permite ejecutar comandos de forma remota. Los detalles del exploit han sido revelados al público. Apple duda de la existencia e implicaciones de esta vulnerabilidad, aunque existen múltiples vídeos públicos que demuestran el ataque. La actualización a la versión 13.0 podría solucionar este problema. Se recomienda actualizar los dispositivos afectados. NOTA: Apple afirma que, tras examinar el informe, no ve ninguna implicación real para la seguridad

*Credits: Marc Ruef
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-06-24 CVE Reserved
  • 2022-06-25 CVE Published
  • 2024-02-14 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-269: Improper Privilege Management
CAPEC
References (3)
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
< 13.0
Search vendor "Apple" for product "Iphone Os" and version " < 13.0"
-
Affected