CVE-2016-7621

EPSS 1.3%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 1.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

22 Dec 2016Public PoC

20 Feb 2017Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows local users to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via unspecified vectors.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/40956/unverified exploitdbwww.exploit-db.com/exploits/40956unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://support.apple.com/HT207422 https://support.apple.com/HT207423 https://support.apple.com/HT207487 https://www.exploit-db.com/exploits/40956/http://www.securityfocus.com/bid/94905 http://www.securitytracker.com/id/1037469