VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 26, 2010· Updated Apr 29, 2026

CVE-2010-3828

CVE-2010-3828

Description

iAd Content Display in Apple iOS before 4.2 allows man-in-the-middle attackers to make calls via a crafted URL in an ad.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apple iOS before 4.2 allows man-in-the-middle attackers to initiate calls via a crafted URL in an iAd, due to insufficient validation.

Vulnerability

In Apple iOS versions before 4.2, the iAd Content Display component fails to properly validate URLs in advertisements. This allows a crafted URL in an ad to be treated as a valid call link, bypassing user confirmation. The issue affects all devices running iOS versions prior to 4.2, including iPhone 3G and later, iPod touch (2nd generation and later), and iPad [1].

Exploitation

An attacker positioned as a man-in-the-middle (MITM) on the network (e.g., on a compromised Wi-Fi network or through a rogue cell tower) can inject a malicious ad into the iAd content stream. The crafted ad contains a specially formatted URL that the phone interprets as a phone call. The attacker does not require any user interaction beyond the user viewing the ad, as the call is initiated without additional prompts [1].

Impact

Successfully exploiting this vulnerability allows the attacker to cause the device to make a phone call to any number specified in the ad URL. This could result in toll fraud (e.g., calling premium-rate numbers) or unexpected charges. The attacker does not gain access to user data or execute arbitrary code; the impact is limited to unauthorized call initiation [1].

Mitigation

Apple addressed this vulnerability in iOS 4.2, released on November 22, 2010. Users should update to iOS 4.2 or later via iTunes. No workaround is available for devices that cannot run iOS 4.2, as these devices are end-of-life and unsupported [1]. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. About the security content of iOS 4.2 - Apple Support

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

30
  • Apple Inc./Iphone Os29 versions
    cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*+ 28 more
    • cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*range: <=4.1
    • cpe:2.3:o:apple:iphone_os:1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:1.1.2:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:1.1.3:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:1.1.4:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:1.1.5:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:2.0:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:2.0.2:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:2.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:2.2:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:2.2.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:3.0:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:3.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:3.2:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:3.2.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:3.2.2:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:4.0:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:o:apple:iphone_os:4.0.2:*:*:*:*:*:*:*
  • Apple Inc./iOSllm-fuzzy
    Range: <4.2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.