BT Spoofing Auth Bypass in Apple AirPods & Beats
CVE-2024-27867 Published on June 26, 2024
An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.
Vulnerability Analysis
CVE-2024-27867 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Products Associated with CVE-2024-27867
Want to know whenever a new CVE is published for Apple AirPods? stack.watch will email you.
Affected Versions
Apple AirPods Firmware Update A, AirPods Firmware Update F, and Beats Firmware Update F:- Version unspecified and below 6 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.