CVE-2021-1863 : Security Advisory and Response

This CVE-2021-1863 article provides details about an issue affecting iOS and iPadOS devices, allowing unauthorized phone calls.

Understanding CVE-2021-1863

This section explains the vulnerability, its impact, technical details, and mitigation steps.

What is CVE-2021-1863?

The vulnerability involved inadequate authentication of actions triggered by NFC tags, enabling potential unauthorized phone calls on iOS and iPadOS devices.

The Impact of CVE-2021-1863

The flaw could be exploited by a person with physical access to an iOS device, potentially leading to unauthorized calls to any phone number.

Technical Details of CVE-2021-1863

This section delves into the vulnerability description, affected systems, and exploitation mechanism.

Vulnerability Description

A weakness in action authentication related to NFC tags allowed for unauthorized phone calls on iOS and iPadOS devices.

Affected Systems and Versions

The vulnerability affects iOS and iPadOS versions earlier than 14.5, with an unspecified custom version.

Exploitation Mechanism

The issue arises from a lack of proper authentication for actions initiated by NFC tags, enabling malicious individuals to make unauthorized phone calls.

Mitigation and Prevention

Here, we discuss the immediate steps to take and long-term security practices to prevent exploitation.

Immediate Steps to Take

Users should update their devices to iOS 14.5 and iPadOS 14.5. Exercise caution with NFC tags until the patch is applied.

Long-Term Security Practices

Employ strict physical access controls and regularly update software to ensure protection against similar vulnerabilities.

Patching and Updates

Apple has addressed this vulnerability in iOS 14.5 and iPadOS 14.5, providing users with secure action authentication to prevent unauthorized phone calls.