CVE-2019-8854

HIGH

iPhone OS <13.2, macOS <10.15, tvOS <13.2, watchOS <6.0 - User Privacy Issue via Wi-Fi MAC Address Tracking

Title source: llm
STIX 2.1

Description

A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in macOS Catalina 10.15, watchOS 6, iOS 13, tvOS 13. A device may be passively tracked by its Wi-Fi MAC address.

References (4)

Core 4
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210634
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210604
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210606
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210607

Scores

CVSS v3 7.5
EPSS 0.0115
EPSS Percentile 63.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Status published
Products (4)
apple/iphone_os < 13.2
apple/mac_os_x < 10.15
apple/tvos < 13.2
apple/watchos < 6.0
Published Oct 27, 2020
Tracked Since Feb 18, 2026