CVE-2017-13903

High

Published: 25/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in certain Apple products, including iOS before 11.2.1 and tvOS before 11.2.1, related to the 'HomeKit' component. It allows remote attackers to modify the application state through incorrect message handling.

Risk Assessment

Attackers can exploit this vulnerability to obtain an encryption key and unlock a door, posing a significant security risk to smart home systems.

Recommendation

It is recommended to update iOS and tvOS to version 11.2.1 or later to mitigate this vulnerability.

Other vulnerabilities in HomeKit

CVE-2017-2434Critical
An issue was discovered in certain Apple products, including iOS before 10.3, related to the 'HomeKit' component. It allows attackers to have an unspecified impact by leveraging the presence of Home Control on Control Center.

Original NVD description (English source)

An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. It allows remote attackers to modify the application state by leveraging incorrect message handling, as demonstrated by use of an Apple Watch to obtain an encryption key and unlock a door.