CVE-2014-4367

Vulnerability

Apple iOS before version 8 allows the Voice Dial feature to remain active during all upgrade actions. This means that while the device is performing a software update, the speech-recognition interface for placing phone calls is still listening for spoken commands. The affected versions include all iOS releases prior to 8, as confirmed by the vendor advisory [1].

Exploitation

An attacker who is physically proximate to the device during the upgrade process can simply speak a telephone number aloud. No authentication, device unlock, or user interaction with the update screen is required; the device's microphone picks up the spoken digits and triggers a call without further verification [1].

Impact

A successful exploit forces the victim's iPhone, iPad, or iPod touch to initiate an outbound phone call to any number spoken by the attacker. This can result in unexpected toll charges, a disruption of the upgrade process, and potential denial-of-service of the device's telephony functions until the call ends [1].

Mitigation

Apple addressed this issue in iOS 8, released on September 17, 2014. Users are advised to update to iOS 8 or later via the Software Update mechanism. No workaround is available for devices that cannot upgrade beyond iOS 7.x, and this CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].