CVE-2010-1756

Vulnerability

The Settings application in Apple iOS versions prior to 4 on iPhone and iPod touch does not properly report the wireless network that is in use [1]. This means the displayed network name may not match the actual network the device is connected to. The issue affects iOS 2.0 through 3.1.3.

Exploitation

A remote attacker can set up a rogue wireless network with a misleading name. When the user's device connects to this network, the Settings application may display an incorrect network identifier, potentially showing a trusted network name instead of the rogue one. The attacker does not require authentication or user interaction beyond the user connecting to the network.

Impact

An attacker can trick users into communicating over an unintended network, leading to potential interception of sensitive data or man-in-the-middle attacks. The user may believe they are on a legitimate network when they are not.

Mitigation

Apple addressed this issue in iOS 4, released on June 21, 2010 [1]. Users should upgrade to iOS 4 or later. No workaround is available for earlier versions. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.