CVE-2017-2352

Vulnerability

The vulnerability exists in the "Unlock with iPhone" component on Apple Watch. In watchOS versions prior to 3.1.3 and iOS versions prior to 10.2.1, the wrist-presence protection mechanism can be bypassed, allowing an attacker to unlock the Watch without the wrist being present. The issue is triggered via unspecified vectors related to the communication between the iPhone and Watch. [1][2]

Exploitation

An attacker with physical access to the paired iPhone (which is already unlocked) can exploit the flaw to unlock the Apple Watch without needing the Watch to detect the wearer's wrist. The exact steps are not publicly detailed, but the attack does not require the attacker to be wearing the Watch. [1][2]

Impact

Successful exploitation allows an attacker to bypass the wrist-detection security of the Apple Watch, unlocking the device and gaining access to its applications, notifications, and sensitive data. This compromises the device's intended protection against unauthorized use when removed from the owner's wrist. [1][2]

Mitigation

Apple addressed the issue in watchOS 3.1.3 and iOS 10.2.1, both released on January 23, 2017. Users should update their devices to the latest OS versions. No workarounds are available for unpatched versions. [1][2]