Vulnerability · Published May 26, 2022 · Assigned by apple
CVE-2022-26766
Medium 5.5
In plain English
A medium-severity improper certificate validation in watchOS from Apple. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)2.8%top 13.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious app may be able to bypass signature validation.
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://support.apple.com/en-us/HT213255 x_refsource_MISC
- https://support.apple.com/en-us/HT213256 x_refsource_MISC
- https://support.apple.com/en-us/HT213258 x_refsource_MISC
- https://support.apple.com/en-us/HT213253 x_refsource_MISC
- https://support.apple.com/en-us/HT213254 x_refsource_MISC
- https://support.apple.com/en-us/HT213257 x_refsource_MISC