HIGH · CVSS 7.8 CISA Known Exploited Vulnerability

CVE-2023-42824

Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability

Apple iOS and iPadOS

The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.

CVSS

7.8

HIGH

EPSS

30-day exploitation

Ransomware groups

recorded exploiting

Published

4 Oct 2023

NVD

Exploitation status

CISA Known Exploited Vulnerabilities

Listed by CISA on 5 October 2023. US federal agencies were required to remediate it by 26 October 2023.

EPSS — exploitation probability

FIRST puts the probability of exploitation activity in the next 30 days at 1%, which is higher than 62.1% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Frequently asked questions

Is CVE-2023-42824 being exploited by ransomware groups?

No ransomware group in this database is currently recorded as exploiting CVE-2023-42824.

What does CVE-2023-42824 affect?

CVE-2023-42824 affects Apple iOS and iPadOS. The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.

How severe is CVE-2023-42824?

CVE-2023-42824 is rated HIGH with a CVSS base score of 7.8. EPSS puts the probability of exploitation in the next 30 days at 1%, higher than 62.1% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 26 October 2023.

How should organisations respond to CVE-2023-42824?

Apply the vendor patch for Apple iOS and iPadOS as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.