CVE-2024-54470

CVE-2024-54470 is a logic issue in the lock screen of iOS and iPadOS that could allow an attacker with physical access to a locked device to access contacts. The flaw was present in versions prior to iOS 17.7.1 and iOS 18.1, as well as corresponding iPadOS versions. Apple addressed the issue with improved checks and authentication [1][2].

Exploitation requires physical access to a locked device. The attacker does not need to unlock the device; they can bypass lock screen restrictions to view contact information. No authentication is needed beyond physical possession. The attack surface is limited to devices running vulnerable iOS/iPadOS versions [1][2].

An attacker could gain access to sensitive contact data, including names, phone numbers, and email addresses, without unlocking the device. This could lead to privacy breaches or further social engineering attacks. The vulnerability is rated Medium with a CVSS v3 score of 4.6 [1][2].

Apple released patches in iOS 17.7.1 and iOS 18.1 on October 28, 2024. Users should update their devices to these or later versions. There is no mention of a workaround; updating is the recommended mitigation [1][2].