CVE-2024-54492

Vulnerability

Overview The vulnerability arises from the use of unencrypted HTTP instead of HTTPS for network communication. This allows an attacker in a privileged network position to modify network traffic [1][2][3][4].

Exploitation

An attacker must be in a privileged network position, such as on the same local network or capable of performing a man-in-the-middle attack, to intercept and alter the traffic [1].

Impact

Successful exploitation could allow the attacker to alter network traffic, potentially leading to data tampering or the injection of malicious content [1][2].

Mitigation

Apple has addressed this issue by switching to HTTPS in the following updates: iOS 18.2, iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, and visionOS 2.2 [1][2][3][4]. Users are advised to update their devices.