Auth bypass in Apple Ipados
CVE-2023-45866
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.079 (94.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.079 · newest: 0.079 · change: 0.000
Affected products
- Apple Ipados
- Apple Iphone OS — versions 16.6
- Apple Iphone Se
- Apple Macbook Air — versions 2017
- Apple Macbook Pro — versions m2
- Apple macOS — versions 12.6.7, 13.3.3
- Bluproducts Dash — versions 3.5
- Google Android — versions 4.2.2, 6.0.1, 10.0
- Google Nexus 5
- Google Pixel 2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- bluetooth.com (Not Applicable)
- changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog (Release Notes)
- github.com/skysafe/reblog/tree/main/cve-2023-45866 (Third Party Advisory)
- git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input (Patch, Mailing List)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- support.apple.com/kb/HT214036 (Third Party Advisory)
- support.apple.com/kb/HT214035 (Third Party Advisory)
- seclists.org/fulldisclosure/2023/Dec/9 (mailing-list, Mailing List, Third Party Advisory)
- seclists.org/fulldisclosure/2023/Dec/7 (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-45866?
- CVE-2023-45866 is a medium-severity vulnerability in Apple Ipados, classified under Improper Authentication. CVSS score: 6.3/10. Published 2023-12-08.
- How severe is CVE-2023-45866?
- Medium severity. CVSS v3 base score is 6.3 out of 10.
- Is CVE-2023-45866 known to be exploited?
- 51 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.