CVE-2024-0230

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0230
A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.0.6. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic.

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.apple.com/en-us/HT214050 Release Notes Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:apple:magic_keyboard_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:apple:magic_keyboard:-:*:*:*:*:*:*:*
History

19 Jan 2024, 18:35

Type Values Removed Values Added
CPE cpe:2.3:h:apple:magic_keyboard:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:magic_keyboard_firmware:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 2.4
First Time Apple
Apple magic Keyboard
Apple magic Keyboard Firmware
References () https://support.apple.com/en-us/HT214050 - () https://support.apple.com/en-us/HT214050 - Release Notes, Third Party Advisory
CWE NVD-CWE-noinfo
Summary
  • (es) Se solucionó un problema de gestión de sesiones con comprobaciones mejoradas. Este problema se solucionó en la actualización de Magic Keyboard Firmware 2.0.6. Un atacante con acceso físico al accesorio puede extraer su clave de emparejamiento de Bluetooth y monitorear el tráfico de Bluetooth.

12 Jan 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-12 23:15

Updated : 2024-01-19 18:35

NVD link : CVE-2024-0230

Mitre link : CVE-2024-0230

CVE.ORG link : CVE-2024-0230

JSON object : View

Products Affected

apple

  • magic_keyboard_firmware
  • magic_keyboard
CWE
NVD-CWE-noinfo