The Cybersecurity and Infrastructure Security Agency, which operates as the self-labelled America’s cyber defense agency, is an official website of the U.S. government. So when CISA issues a warning about a security flaw that impacts Apple devices, including iPhones and is known to be under active exploitation, you’d better be paying attention.
What Is CVE-2022-48618 And Why Has CISA Issued A Security Warning?
CISA has issued a warning concerning a high-rated vulnerability, CVE-2022-48618, which impacts devices running specific versions of iOS, iPadOS, macOS, tvOS, and watchOS. The vulnerability is known to bypass pointer authentication, something that CISA warns is an attack vector for malicious actors that poses “significant risks to the federal enterprise.” However, that warning extends beyond just Federal Civilian Executive Branch agencies, according to CISA, which “strongly urges all organizations” to make a timely response to the issue.
Who Has 21 Days To Comply To The Government Warning?
FCEB agencies, meanwhile, have been given just 21 days to patch against CVE-2022-48618 to protect their networks against the active threat. The threat itself is an old one, thought to be dating back to at least December 2022, although it was only publicly disclosed on January 9. The kernel vulnerability is known to have been targeted by attackers in versions of iOS prior to 15.7.1 and was patched in version 16.2 of iOS, iPadOS and tvOS. It was also patched in macOS Venture 13.1 and watchOS 9.2. As my colleague Kate O’Flaherty reported for Forbes in December 2022, iOS 16.2 fixed more than 30 security vulnerabilities with six “in the Kernel at the heart of the iPhone operating system.”
By adding CVE-2022-48618 to the Known Exploited Vulnerabilities catalog, CISA emphasizes the seriousness of the risk of unpatched devices to federal agencies and beyond. Binding Operational Directive 22-01 requires those agencies to “remediate identified vulnerabilities by the due date” if they have been added to the KEV list.
