CVE-2024-44147

Vulnerability

A state management issue in iOS and iPadOS prior to version 18 allows an app to gain unauthorized access to the Local Network. The vulnerability affects iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later [1].

Exploitation

An app running on the device can exploit this state management flaw to access the Local Network without proper authorization. No user interaction beyond installing the app is required, as the bug is triggered during normal app operation [1].

Impact

Successful exploitation allows the app to interact with other devices on the local network, potentially leading to information disclosure, data exfiltration, or further network-based attacks. The attacker gains unauthorized network access from the compromised device [1].

Mitigation

Apple addressed the issue in iOS 18 and iPadOS 18, released on September 16, 2024. Users should update their devices to the latest operating system version. No workarounds are available for unpatched versions [1].