CVE-2024-23289 is a lock screen vulnerability affecting Apple iOS and iPadOS devices that allows an attacker with physical access to the device to use Siri to retrieve private calendar information without unlocking the device. The root cause is improper state management on the lock screen that permitted Siri to access sensitive calendar data. Apple fixed this issue by improving the lock screen state management in iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, and iPadOS 17.4. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.5 (Attack Vector: Local, Attack Complexity: Low, Privileges Required: Low, User Interaction: None, Scope: Unchanged, Confidentiality: None, Integrity: None, Availability: High). No public exploits are known.

An attacker with physical access to a vulnerable device could use Siri from the lock screen to access private calendar information without authentication. This could lead to unauthorized disclosure of sensitive calendar data. The vulnerability does not impact confidentiality or integrity of other data and does not require user interaction beyond physical access. There are no known exploits in the wild. The impact is limited to privacy exposure of calendar information.

Apple has released official patches that fully address this vulnerability in iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, and iPadOS 17.4. Users and administrators should update affected devices to these versions or later to remediate the issue. Since the vulnerability requires physical access and is fixed by the vendor, no additional mitigations are necessary beyond applying the official updates.