The Indian Computer Emergency Response Team, CERT-In, has raised a significant alarm for users of Apple products in India, highlighting multiple vulnerabilities that could lead to unauthorized access to user data. Issuing a ‘high’ severity warning, the agency has identified a “remote code execution vulnerability” in Apple devices, posing a serious threat of exploitation by hackers.
According to CERT-In’s advisory, the vulnerability impacts iPhone and iPad users using iOS and iPadOS versions earlier than 17.4.1. Notably, this update is accessible for newer iPhone models like iPhone XS and above, along with various iPad models released after the iPad Pro 10.5-inch and iPad mini 5th generation.
Furthermore, the vulnerability extends to iOS and iPad versions preceding the 16.7.7 update, impacting devices such as iPhone 8 and iPhone X, along with select iPad models. Additionally, Apple Safari versions before 17.4.1 on macOS Monterey and macOS Ventura, as well as MacBook users on macOS Venture and macOS Sonoma versions earlier than 13.6.6 and 14.4.1 respectively, are also vulnerable.
Moreover, Vision Pro headset users are cautioned about a vulnerability in VisionOS versions before 1.1.1, further emphasizing the widespread impact of these security concerns.
The vulnerability, attributed to an “out-of-bounds write issue in WebRTC and CoreMedia,” presents a scenario where hackers could manipulate specific links to remotely attack devices, potentially executing arbitrary code. CERT-In underscores the severity of this threat, emphasizing the urgent need for protective measures.
To safeguard Apple devices, users are advised to prioritize software updates and security patches provided by Apple. Additionally, exercising caution when connecting to networks, enabling Two-Factor Authentication (2FA), and downloading apps exclusively from trusted sources like the Apple App Store are recommended practices. Regular data backups and staying informed about security advisories are crucial steps to mitigate risks and ensure ongoing device security.