CVE-2024-23219 is an authentication-related vulnerability in the Reset Services component of Apple iOS and iPadOS that may cause Stolen Device Protection to be unexpectedly disabled. This could undermine the security feature designed to protect stolen devices. The issue was resolved by Apple through improved authentication controls and is fixed in iOS 17.3 and iPadOS 17.3. The vulnerability affects devices starting from iPhone XS and equivalent iPad models. The CVSS 3.1 base score is 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), reflecting a medium severity with impact on integrity but no confidentiality or availability impact. Apple’s advisory explicitly states the fix is included in the mentioned OS updates.

If unpatched, this vulnerability could allow Stolen Device Protection to be disabled unexpectedly, potentially enabling unauthorized users to bypass theft protection mechanisms. This impacts the integrity of device security features but does not affect confidentiality or availability directly. No exploits in the wild have been reported, and the issue requires local access (AV:L) with low attack complexity and no privileges or user interaction needed.

Apple has released official fixes for this vulnerability in iOS 17.3 and iPadOS 17.3. Users and administrators should update affected devices to these versions or later to remediate the issue. Since this is not a cloud service, patching the device OS is required. No additional mitigation steps are indicated by the vendor advisory.