CVE-2017-6994

EPSS 4.2%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 4.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

22 May 2017Published on NVD

26 Aug 2017Public PoC

Weaponization speed

96 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/42555/unverified exploitdbwww.exploit-db.com/exploits/42555unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://support.apple.com/HT207798 https://support.apple.com/HT207800 https://support.apple.com/HT207801 https://www.exploit-db.com/exploits/42555/http://www.securityfocus.com/bid/98571