CVE-2024-40818 in watchOS
Summary
by MITRE • 07/30/2024
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, watchOS 10.6. An attacker with physical access may be able to use Siri to access sensitive user data.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/04/2026
This vulnerability represents a significant security flaw in Apple's mobile and desktop operating systems that allows unauthorized access to sensitive user data through voice commands when a device is locked. The issue specifically relates to the improper handling of Siri functionality on locked devices, where attackers with physical access could potentially exploit this weakness to bypass normal authentication mechanisms and gain access to personal information. The vulnerability affects multiple Apple operating systems including iOS, iPadOS, macOS, and watchOS, demonstrating the widespread nature of this security concern. According to industry standards, this type of vulnerability would be classified under CWE-284 Access Control, which specifically addresses improper access control mechanisms that allow unauthorized users to access resources or data.
The technical implementation of this flaw stems from the way Siri processes voice commands when a device is in a locked state. Normally, when a device is locked, certain functionalities should be restricted to prevent unauthorized access to sensitive data. However, this vulnerability allowed Siri to respond to specific voice commands even when the device was secured, potentially enabling an attacker to access contacts, messages, photos, and other personal information. The flaw essentially creates a bypass mechanism that allows voice-based access to device features that should normally be restricted. This represents a critical failure in the device's security model where the normal authentication barriers are circumvented through voice interaction.
The operational impact of this vulnerability is particularly concerning given that it requires only physical access to a device to exploit. An attacker with access to a locked device could potentially use Siri to perform actions such as sending messages, accessing photos, reading contacts, or even initiating phone calls without proper authentication. This creates a significant risk for users who leave their devices unattended or in accessible locations. The vulnerability essentially undermines the fundamental security principle that a locked device should prevent unauthorized access to its contents, making it a serious concern for both personal and enterprise security environments. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and credential access through physical access vectors.
Apple addressed this vulnerability through a comprehensive fix that restricts the options available through Siri on locked devices across all affected operating systems. The remediation involves implementing stricter access controls that prevent Siri from executing commands that could expose sensitive data when the device is locked. The patches were released in specific versions including iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, and watchOS 10.6. These updates ensure that voice commands through Siri are properly restricted on locked devices, preventing unauthorized access to user data. Organizations and users should immediately apply these updates to protect against potential exploitation of this vulnerability. The fix demonstrates Apple's commitment to addressing security concerns through timely patches while maintaining the usability of voice-based interfaces for legitimate users who have proper authentication.