CVE-2024-40840

MEDIUM

iPadOS < 18.0 - Unauthenticated Sensitive Data Exposure via Siri

Title source: llm
STIX 2.1

Description

This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to use Siri to access sensitive user data.

References (2)

Core 2
Core References
Release Notes, Vendor Advisory
https://support.apple.com/en-us/121250

Scores

CVSS v3 4.6
EPSS 0.0006
EPSS Percentile 20.2%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (3)
Apple/iOS and iPadOS < 18
apple/ipados < 18.0
apple/iphone_os < 18.0
Published Sep 17, 2024
Tracked Since Feb 18, 2026