CVE-2024-23210 is a vulnerability identified in Apple iOS and iPadOS operating systems, where an application may be able to access a user's phone number by reading system logs. This issue arises due to insufficient redaction of sensitive information in system logs, allowing potentially unauthorized apps to extract personally identifiable information (PII) such as the phone number. The vulnerability affects multiple Apple platforms, including iOS, iPadOS, macOS Sonoma 14.3, watchOS 10.3, and tvOS 17.3, with the fix implemented in these versions by improving the redaction process to prevent sensitive data exposure. The CVSS 3.1 base score is 3.3, indicating a low severity level. The attack vector is local (AV:L), requiring local access to the device, no privileges required (PR:N), but user interaction is necessary (UI:R). The vulnerability impacts confidentiality only (C:L), with no effect on integrity or availability. The weakness is classified under CWE-532, which relates to exposure of sensitive information in logs. There are no known exploits in the wild at this time. The vulnerability primarily concerns privacy and data leakage rather than system compromise or denial of service.

For European organizations, the exposure of phone numbers through system logs can lead to privacy violations and potential non-compliance with data protection regulations such as the GDPR. Phone numbers are considered personal data, and unauthorized access or leakage could result in reputational damage, regulatory fines, and loss of customer trust. While the vulnerability does not allow for system compromise or data manipulation, the leakage of phone numbers could facilitate targeted phishing, social engineering, or identity theft attacks against employees or customers. Organizations relying on Apple devices for communication or mobile workforce management should be aware of this risk. The impact is more pronounced in sectors handling sensitive communications, such as finance, healthcare, and government, where phone numbers may be linked to critical accounts or services.

European organizations should ensure that all Apple devices are updated to the fixed versions: iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, watchOS 10.3, and tvOS 17.3 or later. Device management policies should enforce timely patching and updates. Additionally, organizations should audit installed applications to limit the installation of untrusted or unnecessary apps that could exploit this vulnerability. Employ Mobile Device Management (MDM) solutions to restrict app permissions and monitor app behavior. Educate users about the risks of installing apps from unverified sources and the importance of applying system updates promptly. For highly sensitive environments, consider restricting local access to devices and implementing additional logging and monitoring to detect unusual access patterns to system logs. Finally, review and enhance data privacy policies to address potential leakage of personal information through logs.