CVE-2018-4172

MEDIUM

iPhone OS < 11.3 - Unauthenticated iCloud Password Bypass via Find My iPhone Backup Restore

Title source: llm
STIX 2.1

Description

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Find My iPhone" component. It allows physically proximate attackers to bypass the iCloud password requirement for disabling the "Find My iPhone" feature via vectors involving a backup restore.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040604
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208693
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/103578

Scores

CVSS v3 4.6
EPSS 0.0040
EPSS Percentile 32.2%
Attack Vector PHYSICAL
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (1)
apple/iphone_os < 11.3
Published Apr 03, 2018
Tracked Since Feb 18, 2026