CVE-2023-28202

MEDIUM

iPadOS < 16.5 - Weak Password Recovery Mechanism for Forgotten Password

Title source: llm

Description

This issue was addressed with improved state management. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app firewall setting may not take effect after exiting the Settings app.

References (4)

Core 4

Core References

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213757

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213758

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213761

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT213764

Scores

CVSS v3 5.5

EPSS 0.0021

EPSS Percentile 11.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-640

Status published

Products (5)

apple/ipados < 16.5

apple/iphone_os < 16.5

apple/macos 13.0 - 13.4

apple/tvos < 16.5

apple/watchos < 9.5

Published Jun 23, 2023

Tracked Since Feb 18, 2026