CVE-2024-23277
MEDIUMiPadOS 17.0-17.3 and iPhoneOS 17.0-17.3 - Keystroke Injection via Spoofed Keyboard
Title source: llmDescription
The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard.
References (7)
Core 7
Core References
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/21
Vendor Advisory
https://support.apple.com/en-us/HT214081
Vendor Advisory
https://support.apple.com/en-us/HT214084
Vendor Advisory
https://support.apple.com/kb/HT214081
Vendor Advisory
https://support.apple.com/kb/HT214084
Scores
CVSS v3
5.9
EPSS
0.0026
EPSS Percentile
49.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
Status
published
Products (5)
Apple/iOS and iPadOS
< 17.4
apple/ipad_os
17.0 - 17.4
apple/iphone_os
17.0 - 17.4
Apple/macOS
< 14.4
apple/macos
14.0 - 14.4
Published
Mar 08, 2024
Tracked Since
Feb 18, 2026