CVE-2019-8548 Information disclosure in watchOS
An attacker with physical access could potentially view partially entered passcodes if the device sleeps before clearing the input field.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-8548?
CVE-2019-8548 is a low-severity vulnerability in Apple Watchos, published on 18 Dec 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue existed where partially entered passcodes may not clear when the device went to sleep. This issue was addressed by clearing the passcode when a locked device sleeps. This issue is fixed in watchOS 5.2. A partially entered passcode may not clear when the device goes to sleep.
Weakness: CWE-459
Which versions are affected by CVE-2019-8548?
It affects 1 product.
Products include Apple Watchos.
How do I fix CVE-2019-8548?
No fix has been published for CVE-2019-8548 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-8548 being exploited?
There is no known exploitation of CVE-2019-8548 in the wild and no public exploit code.
Other vulnerabilities in Apple Watchos
Sources
Also known as GHSA-4rr6-6h9f-r3pg.