This vulnerability (CVE-2024-44276) involves the potential leakage of sensitive information by a user in a privileged network position on Apple iOS and iPadOS devices. The root cause was the lack of HTTPS encryption when sending information over the network, allowing interception or leakage of data. Apple resolved the issue by mandating HTTPS usage in iOS 18.2 and iPadOS 18.2, mitigating the risk of data exposure over the network. The CVSS v3.1 base score is 7.3, reflecting a high severity with network attack vector, low attack complexity, required privileges, and user interaction. The vulnerability is categorized under CWE-319 (Cleartext Transmission of Sensitive Information).

An attacker positioned on the same network as the affected device with some privileges could intercept sensitive information transmitted without encryption. This could lead to confidentiality breaches impacting user data. The vulnerability does not affect availability and requires user interaction. No known active exploitation has been reported.

Apple has released an official fix for this vulnerability in iOS 18.2 and iPadOS 18.2. Users and administrators should update affected devices to these versions or later to ensure the vulnerability is remediated. Since this is not a cloud service, patching the device software is necessary. There are no additional vendor advisories indicating alternative mitigations or that no action is required.