Privilege escalation in Apple iOS
CVE-2019-25071
A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications.
Vulnerability class: Privilege Escalation
EPSS: 0.012 (64.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.
Affected products
- Apple Ios — versions 12.4.0, 12.4.1
- Apple Iphone_os
Weakness classification (CWE)
References
- product-security@apple.com (x_refsource_MISC)
- product-security@apple.com (x_refsource_MISC)
- product-security@apple.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-25071?
- CVE-2019-25071 is a medium-severity vulnerability in Apple iOS, classified under Improper Privilege Management. CVSS score: 6.3/10. Published 2022-06-25.
- How severe is CVE-2019-25071?
- Medium severity. CVSS v3 base score is 6.3 out of 10.