Vulnerability · Published Jan 12, 2024 · Assigned by apple
CVE-2024-0230
Low 2.4
In plain English
A low-severity security flaw in Magic Keyboard Firmware from Apple. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)1.2%top 31.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.0.6. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apple | Magic Keyboard Firmware | 0 – before 2.0.6 |