CVE-2016-7664

Vulnerability

The vulnerability exists in the Accessibility component of iOS versions prior to 10.2. During lockscreen access, excessive options are available, allowing a physically proximate attacker to obtain sensitive photo and contact information. Affected devices include iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later [1].

Exploitation

An attacker must have physical proximity to the locked device. By leveraging the excessive options presented on the lockscreen, the attacker can navigate to access photos and contacts without authentication. No special tools or authentication are required beyond physical access.

Impact

Successful exploitation results in unauthorized disclosure of sensitive photo and contact information. The attacker gains access to personal data without unlocking the device, compromising confidentiality.

Mitigation

Apple addressed this issue in iOS 10.2, released on December 12, 2016 [1]. Users should update to iOS 10.2 or later. No workarounds are documented; updating is the recommended mitigation.