Improved State Management Fixes Authentication Issue
CVE-2024-27867

4.3MEDIUM

Key Information:

Vendor

Apple
Status
Airpods
Vendor
CVE Published:
26 June 2024

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2024-27867?

The CVE-2024-27867 vulnerability affects a wide range of Apple’s wireless audio devices, including AirPods (2nd generation and later), AirPods Pro (all models), AirPods Max, Powerbeats Pro, and Beats Fit Pro. It allows an attacker within Bluetooth range to spoof the intended source device and gain unauthorized access to the headphones. The impact of the vulnerability is significant, as it could allow attackers to intercept audio streams, inject malicious audio, or gain access to the device’s microphone. Apple has released firmware updates to address the issue, and users are urged to update their devices promptly to mitigate the risk. While the risk of exploitation is considered small, updating devices to the latest firmware is recommended to ensure security and optimal performance.

Affected Version(s)

AirPods 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

pspgo-airpods-802F0130
Created by Hirador

News Articles

favicon imageForbes

Apple Issues New AirPods Security Update For Eavesdropping Flaw

Apple has issued an update for AirPods to fix a flaw that could allow an attacker to eavesdrop on your conversations. Here's what you need to know.

favicon imageCybersecurityNews

Apple AirPods Bluetooth Vulnerability Lets Attackers Gain Access to Device

Apple has recently released critical firmware updates for its AirPods and Beats headphones to address a significant Bluetooth vulnerability.

favicon imageMagasin MACKEN

Apple åtgärdar allvarligt säkerhetsbugg i Bluetooth - som kan exploateras för att avlyssna dig

Buggen har fått namnet CVE-2024-27867, och det är ett autentiseringsproblem, som finns i mjukvara för AirPods (andra generationen och senare), AirPods Pro (alla…

References

https://support.apple.com/en-us/120907

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • đź‘ľ

    Exploit known to exist

  • đź“°

    First article discovered by Magasin MACKEN

  • Vulnerability published

  • Vulnerability Reserved

.