Skip to content
OpenAdvisories
Unscored Public exploit CVE-2020-9992 EUVD-2020-30771GHSA-xvpf-r299-6m5q

This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This i…

Published Oct 16, 2020 · Updated Aug 4, 2024 · Assigned by apple

Vendor: Apple Product: iOS Product: Xcode Platform: iOS

Description

This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network.

Affected products

VendorProductAffectedFixed
Apple iOS unspecified – < iOS 14.0 and iPadOS 14.0 iOS 14.0 and iPadOS 14.0
Apple Xcode unspecified – < Xcode 12.0 Xcode 12.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • c0ntextomy/c0ntextomy ★ 73 · Sep 16, 2020

    CVE-2020-9992 - A design flaw in MobileDevice.framework/Xcode and iOS/iPadOS/tvOS Development Tools allows an attacker in the same network to gain remote code execution on a target device

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References