CVE-2024-23277: An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard in Apple iOS and iPadOS
CVE-2024-23277 is a medium severity vulnerability affecting Apple iOS, iPadOS, and macOS Sonoma. It allows an attacker in a privileged network position to inject keystrokes by spoofing a Bluetooth keyboard. The issue was addressed by Apple with improved checks and is fixed in iOS 17. 4, iPadOS 17. 4, and macOS Sonoma 14. 4. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
This vulnerability involves the Bluetooth component of Apple devices running iOS, iPadOS, and macOS Sonoma, where an attacker positioned on the same network with elevated privileges could spoof a Bluetooth keyboard device and inject keystrokes. The flaw was mitigated by Apple through enhanced validation and checks in the affected Bluetooth handling code. The fix is included in the security updates released in iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4.
Potential Impact
An attacker with privileged network access could inject arbitrary keystrokes by spoofing a Bluetooth keyboard, potentially leading to unauthorized input on the device. This could allow manipulation of the device's user interface or input fields without user consent. The CVSS score of 5.9 reflects a medium severity impact with no confidentiality or availability impact but high integrity impact.
Mitigation Recommendations
Apple has released official fixes for this vulnerability in iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4. Users and administrators should apply these updates promptly to remediate the issue. Since this is not a cloud service, patching the affected devices is required. There are no vendor advisories indicating that no action is required or that the issue is mitigated by other means.
CVE-2024-23277: An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard in Apple iOS and iPadOS
Description
CVE-2024-23277 is a medium severity vulnerability affecting Apple iOS, iPadOS, and macOS Sonoma. It allows an attacker in a privileged network position to inject keystrokes by spoofing a Bluetooth keyboard. The issue was addressed by Apple with improved checks and is fixed in iOS 17. 4, iPadOS 17. 4, and macOS Sonoma 14. 4. There are no known exploits in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves the Bluetooth component of Apple devices running iOS, iPadOS, and macOS Sonoma, where an attacker positioned on the same network with elevated privileges could spoof a Bluetooth keyboard device and inject keystrokes. The flaw was mitigated by Apple through enhanced validation and checks in the affected Bluetooth handling code. The fix is included in the security updates released in iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4.
Potential Impact
An attacker with privileged network access could inject arbitrary keystrokes by spoofing a Bluetooth keyboard, potentially leading to unauthorized input on the device. This could allow manipulation of the device's user interface or input fields without user consent. The CVSS score of 5.9 reflects a medium severity impact with no confidentiality or availability impact but high integrity impact.
Mitigation Recommendations
Apple has released official fixes for this vulnerability in iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4. Users and administrators should apply these updates promptly to remediate the issue. Since this is not a cloud service, patching the affected devices is required. There are no vendor advisories indicating that no action is required or that the issue is mitigated by other means.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apple
- Date Reserved
- 2024-01-12T22:22:21.498Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 690a47556d939959c8022a80
Added to database: 11/4/2025, 6:35:01 PM
Last enriched: 4/9/2026, 11:07:29 PM
Last updated: 5/9/2026, 8:41:22 AM
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.