{"containers": {"cna": {"affected": [{"product": "iOS", "vendor": "Apple", "versions": [{"status": "affected", "version": "12.4.0"}, {"status": "affected", "version": "12.4.1"}]}], "credits": [{"lang": "en", "value": "Marc Ruef"}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-30T17:10:10.000Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.scip.ch/en/?labs.20191010"}, {"tags": ["x_refsource_MISC"], "url": "https://youtu.be/AeuGjMbAirU"}, {"tags": ["x_refsource_MISC"], "url": "https://vuldb.com/?id.143125"}], "title": "Apple iOS Siri Self privileges management", "x_generator": "vuldb.com", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "product-security@apple.com", "ID": "CVE-2019-25071", "REQUESTER": "cna@vuldb.com", "STATE": "PUBLIC", "TITLE": "Apple iOS Siri Self privileges management"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "iOS", "version": {"version_data": [{"version_value": "12.4.0"}, {"version_value": "12.4.1"}]}}]}, "vendor_name": "Apple"}]}}, "credit": "Marc Ruef", "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications."}]}, "generator": "vuldb.com", "impact": {"cvss": {"baseScore": "6.3", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-269 Improper Privilege Management"}]}]}, "references": {"reference_data": [{"name": "https://www.scip.ch/en/?labs.20191010", "refsource": "MISC", "url": "https://www.scip.ch/en/?labs.20191010"}, {"name": "https://youtu.be/AeuGjMbAirU", "refsource": "MISC", "url": "https://youtu.be/AeuGjMbAirU"}, {"name": "https://vuldb.com/?id.143125", "refsource": "MISC", "url": "https://vuldb.com/?id.143125"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:00:19.391Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.scip.ch/en/?labs.20191010"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://youtu.be/AeuGjMbAirU"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://vuldb.com/?id.143125"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-30T16:45:32.667035Z", "id": "CVE-2019-25071", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T16:45:36.998Z"}}]}, "cveMetadata": {"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2019-25071", "datePublished": "2022-06-25T06:10:12.000Z", "dateReserved": "2022-06-24T00:00:00.000Z", "dateUpdated": "2025-05-30T16:45:36.998Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.scip.ch/en/?labs.20191010", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://youtu.be/AeuGjMbAirU", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://vuldb.com/?id.143125", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:00:19.391Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-25071", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-30T16:45:32.667035Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T16:42:56.593Z"}}], "cna": {"title": "Apple iOS Siri Self privileges management", "credits": [{"lang": "en", "value": "Marc Ruef"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Apple", "product": "iOS", "versions": [{"status": "affected", "version": "12.4.0"}, {"status": "affected", "version": "12.4.1"}]}], "references": [{"url": "https://www.scip.ch/en/?labs.20191010", "tags": ["x_refsource_MISC"]}, {"url": "https://youtu.be/AeuGjMbAirU", "tags": ["x_refsource_MISC"]}, {"url": "https://vuldb.com/?id.143125", "tags": ["x_refsource_MISC"]}], "x_generator": "vuldb.com", "descriptions": [{"lang": "en", "value": "A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2022-06-30T17:10:10.000Z"}, "x_legacyV4Record": {"credit": "Marc Ruef", "impact": {"cvss": {"version": "3.1", "baseScore": "6.3", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"}}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "12.4.0"}, {"version_value": "12.4.1"}]}, "product_name": "iOS"}]}, "vendor_name": "Apple"}]}}, "data_type": "CVE", "generator": "vuldb.com", "references": {"reference_data": [{"url": "https://www.scip.ch/en/?labs.20191010", "name": "https://www.scip.ch/en/?labs.20191010", "refsource": "MISC"}, {"url": "https://youtu.be/AeuGjMbAirU", "name": "https://youtu.be/AeuGjMbAirU", "refsource": "MISC"}, {"url": "https://vuldb.com/?id.143125", "name": "https://vuldb.com/?id.143125", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-269 Improper Privilege Management"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-25071", "STATE": "PUBLIC", "TITLE": "Apple iOS Siri Self privileges management", "ASSIGNER": "product-security@apple.com", "REQUESTER": "cna@vuldb.com"}}}}, "cveMetadata": {"cveId": "CVE-2019-25071", "state": "PUBLISHED", "dateUpdated": "2025-05-30T16:45:36.998Z", "dateReserved": "2022-06-24T00:00:00.000Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2022-06-25T06:10:12.000Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "03E861BE-9AB7-45CE-8977-BA832ACB6F30", "versionEndExcluding": "13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en el iPhone de Apple hasta la versi\u00f3n 12.4.1. Ha sido declarada como cr\u00edtica. Esta vulnerabilidad afecta a Siri. La reproducci\u00f3n de un archivo de audio o v\u00eddeo podr\u00eda iniciar Siri en el mismo dispositivo, lo que permite ejecutar comandos de forma remota. Los detalles del exploit han sido revelados al p\u00fablico. Apple duda de la existencia e implicaciones de esta vulnerabilidad, aunque existen m\u00faltiples v\u00eddeos p\u00fablicos que demuestran el ataque. La actualizaci\u00f3n a la versi\u00f3n 13.0 podr\u00eda solucionar este problema. Se recomienda actualizar los dispositivos afectados. NOTA: Apple afirma que, tras examinar el informe, no ve ninguna implicaci\u00f3n real para la seguridad"}], "id": "CVE-2019-25071", "lastModified": "2024-11-21T04:39:53.167", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "product-security@apple.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-25T06:15:07.150", "references": [{"source": "product-security@apple.com", "url": "https://vuldb.com/?id.143125"}, {"source": "product-security@apple.com", "url": "https://www.scip.ch/en/?labs.20191010"}, {"source": "product-security@apple.com", "url": "https://youtu.be/AeuGjMbAirU"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://vuldb.com/?id.143125"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.scip.ch/en/?labs.20191010"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://youtu.be/AeuGjMbAirU"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "product-security@apple.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}