Urgent: Apple Issues Critical Updates for Actively Exploited Zero

Sunhillo SureLine before version 8.7.0.1.1 contains an unauthenticated OS command injection flaw (CWE-78) in its /cgi/networkDiag.cgi web endpoint. An attacker with network access to the device's management interface can inject shell metacharacters into the ipAddr or dnsAddr parameters, causing arbitrary operating system commands to be executed with the privileges of the web service. Because no authentication or user interaction is required (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N), a remote attacker can achieve full command execution, with high impact on confidentiality, integrity, and availability of the device. SureLine is Sunhillo's surveillance data distribution platform used primarily in the aviation sector (airports and air traffic control facilities), so affected users are mainly those organizations rather than the general public. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2024-03-05, indicating it has been observed being exploited in the wild, and a public technical advisory with a proof of concept was published by NCC Group in July 2021.

Do: Upgrade SureLine to version 8.7.0.1.1 or later. If upgrading is not immediately possible, restrict network access to the device's management interface (especially the /cgi/networkDiag.cgi endpoint) and place the unit behind a firewall or VPN rather than exposing it directly to the internet. Note that as a KEV-listed vulnerability, CISA requires applying vendor mitigations or discontinuing use of the product, so inventory any internet-exposed SureLine appliances and check logs for unexpected requests to networkDiag.cgi.

CVE-2023-21237 is an information disclosure flaw (CWE-200) in the applyRemoteView function of NotificationContentInflater.java on Android 13, where misleading or insufficient UI can cause a foreground service notification to be hidden from the user. A locally installed app with only low privileges can trigger the condition without any user interaction, causing the system not to visibly display the app's foreground service notification. An attacker gains a covert execution context: the user receives no indication that an app or service is running, which Google classifies as local information disclosure because the user is deprived of awareness of activity on their device. Affected users are those with Google Pixel devices running Android 13, per CISA's advisory. The bug was added to CISA's Known Exploited Vulnerabilities catalog on 2024-03-05, confirming in-the-wild exploitation, though EPSS currently estimates only a 0.3% probability of exploitation in the next 30 days and no public PoC is known.

Do: Apply Google's latest Pixel/Android monthly security update to all Android 13 Pixel devices, prioritizing fleet patching per the CISA KEV required action, and verify devices report a security patch level that includes this fix. As a detection aid, review installed apps that run foreground services whose notifications are not visible, since hiding the foreground service notification is the core abuse of this flaw. If patching is not possible, follow vendor mitigations per CISA guidance or discontinue use of affected devices.

CVE-2024-23222 is a type confusion flaw (CWE-843) in Apple's WebKit engine that allows arbitrary code execution when a device processes maliciously crafted web content, for example when a user is lured into loading attacker-controlled web pages in Safari or another WebKit-based view (the CVSS vector confirms user interaction is required). It affects a broad slice of the Apple ecosystem: Safari, iPhone OS/iPadOS on the iOS 15, 16 and 17 branches, macOS Monterey/Ventura/Sonoma, tvOS and visionOS, prior to the January 22, 2024 fixes. A successful attacker gains code execution on the target device with high impact on confidentiality, integrity and availability (CVSS 3.1: 8.8). The flaw was fixed in Safari 17.3, iOS/iPadOS 17.3, and backported to iOS/iPadOS 15.8.7 and 16.7.5 for devices that cannot upgrade to iOS 17, plus macOS Monterey 12.7.3, Ventura 13.6.4, Sonoma 14.3, tvOS 17.3 and visionOS 1.0.2. Exploitation is confirmed in the wild: the vulnerability was added to CISA KEV on 2024-01-23, one day after the fixes shipped, and is associated with the Coruna exploit kit, which reportedly chains multiple exploits to target iOS devices including older versions.

Do: Update all affected devices to Safari 17.3, iOS/iPadOS 17.3 (or the iOS/iPadOS 15.8.7 and 16.7.5 backports for devices that cannot run 17), macOS Monterey 12.7.3, macOS Ventura 13.6.4, macOS Sonoma 14.3, tvOS 17.3 and visionOS 1.0.2. Prioritize endpoints used for web browsing and mobile users, since exploitation only requires a user to process crafted web content. The CISA KEV listing (added 2024-01-23) makes applying these vendor updates mandatory under the KEV required action, so verify fleet versions and confirm no devices remain on pre-patch builds.

CVE-2024-23225 is a memory-corruption flaw (CWE-787, out-of-bounds write) in the kernels of Apple's iOS, iPadOS, macOS, tvOS, visionOS and watchOS, addressed with improved memory validation in Apple's March 2024 updates. It is triggered locally (CVSS AV:L/PR:L/UI:N) after an attacker has already obtained arbitrary kernel read and write capability, typically as the final stage of an exploit chain, and requires no user interaction. Successful abuse lets the attacker bypass the kernel's memory protections, converting an existing kernel read/write primitive into deeper and more reliable system compromise. Affected users are those running iPhone/iPad software older than iOS/iPadOS 17.4 (or 16.7.6 on the iOS 16 line), Macs older than macOS Sonoma 14.4 / Ventura 13.6.5 / Monterey 12.7.4, Apple TV units older than tvOS 17.4, Apple Vision Pro units older than visionOS 1.1, and Apple Watch units older than watchOS 10.4. Apple has stated the issue may have been exploited in the wild, CISA added it to the KEV on 2024-03-06 as part of the March 2024 emergency update batch, and EPSS currently assigns a 1.5% probability of exploitation within 30 days (72nd percentile).

Do: Patch immediately to iOS/iPadOS 17.4 (or 16.7.6 for devices that cannot run 17), macOS Sonoma 14.4 / Ventura 13.6.5 / Monterey 12.7.4, tvOS 17.4, visionOS 1.1 and watchOS 10.4; there is no known workaround, so updating is the only mitigation. Because the flaw is KEV-listed, federal agencies must apply the vendor fixes within the BOD 22-01 deadline, and all defenders should verify installed OS versions fleet-wide (e.g., via MDM) and prioritize internet-facing and high-risk users.