CERT-In, India‘s cybersecurity agency, has issued a high severity warning for users of Apple iPhones, MacBooks, iPads, and Vision Pro headsets due to a critical vulnerability. This alert underscores the urgency of the situation and the potential risk posed to the security of these specific devices.
The identified vulnerability is classified as a “remote code execution vulnerability,” indicating its severity. This type of vulnerability allows attackers to execute arbitrary code on the affected devices remotely, potentially leading to unauthorized access and manipulation of sensitive data on iPhones, MacBooks, iPads, and Vision Pro headsets.
CERT-In’s investigation has identified the root cause of this vulnerability as an “out-of-bounds write issue in WebRTC and CoreMedia.” This technical detail sheds light on the specific area of vulnerability within the affected systems of iPhones, MacBooks, iPads, and Vision Pro headsets.
The affected systems include Android Versions 12, 12L, 13, and 14, as well as Apple Safari versions before 17.4.1, and iOS and iPadOS versions before 17.4.1 and 16.7.7.
Additionally, Mozilla Firefox versions prior to 124.0.1 are also flagged as vulnerable.
Attackers may exploit this vulnerability by enticing users of iPhones, MacBooks, iPads, and Vision Pro headsets to visit specific links, thereby triggering the vulnerability upon access. This highlights the importance of user vigilance and awareness in safeguarding against potential threats targeting these devices.
CERT-In emphasizes the seriousness of the situation, cautioning that successful exploitation of these vulnerabilities could result in unauthorized access to sensitive information stored on iPhones, MacBooks, iPads, and Vision Pro headsets. Additionally, it warns of the possibility of denial of service attacks, which could disrupt normal operations of these devices.
Given the gravity of these vulnerabilities affecting iPhones, MacBooks, iPads, and Vision Pro headsets, CERT-In urges users to take immediate action to mitigate the risk. This includes promptly updating their affected devices with the latest security patches provided by Apple and following best practices for cybersecurity hygiene to minimize exposure to potential threats.
