CVEvulnerability
CVE-2017-13903
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-12-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Description
An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. It allows remote attackers to modify the application state by leveraging incorrect message handling, as demonstrated by use of an Apple Watch to obtain an encryption key and unlock a door.
Affected configurations
• apple iphone os (< 11.2.1)
• apple tvos (< 11.2.1)
References
- http://www.securityfocus.com/bid/102182 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040008 Third Party Advisory, VDB Entry
- https://support.apple.com/HT208357 Vendor Advisory
- https://support.apple.com/HT208359 Vendor Advisory
- https://www.engadget.com/2017/12/21/apple-ignored-a-major-homekit-security-flaw-for-six-weeks/ Press/Media Coverage
- http://www.securityfocus.com/bid/102182 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040008 Third Party Advisory, VDB Entry
- https://support.apple.com/HT208357 Vendor Advisory
- https://support.apple.com/HT208359 Vendor Advisory
- https://www.engadget.com/2017/12/21/apple-ignored-a-major-homekit-security-flaw-for-six-weeks/ Press/Media Coverage