CVE-2014-4451

Vulnerability

The vulnerability exists in iOS lock-screen implementation. When a user exceeds the failed passcode attempts limit, iOS should disable further attempts or wipe data. However, iOS versions before 8.1.1 do not properly enforce this limit, allowing an attacker to continue guessing passcodes without triggering the protection mechanism. Affected versions: iOS prior to 8.1.1. [1][2]

Exploitation

An attacker with physical proximity to the locked device can repeatedly enter incorrect passcodes without being blocked by the device's security policy. No prior authentication is required; the attacker only needs physical access to the device. The passcode limit can be bypassed by restarting the device or other means not fully disclosed. [1][2]

Impact

Successful exploitation enables an attacker to bypass the lock-screen protection and gain unauthorized access to the device, potentially exposing all user data such as contacts, emails, and installed app data. The attacker may also be able to launch apps or view notifications. [1][2]

Mitigation

Apple addressed the issue in iOS 8.1.1, released on November 17, 2014. Users should update to iOS 8.1.1 or later via Settings > General > Software Update. [1][2]