Description
An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. It allows remote attackers to modify the application state by leveraging incorrect message handling, as demonstrated by use of an Apple Watch to obtain an encryption key and unlock a door.
Metrics
CVSS 3.0 7.5/10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NAffected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://www.securityfocus.com/bid/102182Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040008Third Party Advisory, VDB Entry
- https://support.apple.com/HT208357Vendor Advisory
- https://support.apple.com/HT208359Vendor Advisory
- https://www.engadget.com/2017/12/21/apple-ignored-a-major-homekit-security-flaw-for-six-weeks/Press/Media Coverage
- http://www.securityfocus.com/bid/102182Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040008Third Party Advisory, VDB Entry
- https://support.apple.com/HT208357Vendor Advisory
- https://support.apple.com/HT208359Vendor Advisory
- https://www.engadget.com/2017/12/21/apple-ignored-a-major-homekit-security-flaw-for-six-weeks/Press/Media Coverage
Timeline
- Published
- Dec 25, 2017
- Last modified
- Jun 17, 2026
- NVD status
- Modified