CVE-2024-27867

Опубликовано: 26 июн. 2024

Источник: nvd

CVSS3: 4.3

CVSS3: 3.3

EPSS Низкий

Описание

An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.

Ссылки

http://seclists.org/fulldisclosure/2024/Jul/2
Mailing List
https://support.apple.com/en-us/HT214111
Vendor Advisory
https://support.apple.com/kb/HT214111
Vendor Advisory
http://seclists.org/fulldisclosure/2024/Jul/2
Mailing List
https://support.apple.com/en-us/HT214111
Vendor Advisory
https://support.apple.com/kb/HT214111
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:apple:airpods_firmware:*:*:*:*:*:*:*:*

Версия до 6a326 (исключая)

cpe:2.3:h:apple:airpods:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:apple:powerbeats_firmware:*:*:*:*:*:*:*:*

Версия до 6f8 (исключая)

cpe:2.3:h:apple:powerbeats:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:apple:airpods_pro_firmware:*:*:*:*:*:*:*:*

Версия до 6f8 (исключая)

cpe:2.3:h:apple:airpods_pro:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:apple:beats_fit_pro_firmware:*:*:*:*:*:*:*:*

Версия до 6f8 (исключая)

cpe:2.3:h:apple:beats_fit_pro:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:apple:airpods_max_firmware:*:*:*:*:*:*:*:*

Версия до 6f8 (исключая)

cpe:2.3:h:apple:airpods_max:-:*:*:*:*:*:*:*

EPSS

Процентиль: 25%

0.00084

Низкий

4.3 Medium

CVSS3

3.3 Low

CVSS3

Дефекты

CWE-287

Связанные уязвимости

GHSA-hjp4-5jqf-9vgq

CVSS3: 3.3

github

больше 1 года назад

EPSS

Процентиль: 25%

0.00084

Низкий

4.3 Medium

CVSS3

3.3 Low

CVSS3

Дефекты

CWE-287