Security readout for executives and security teams
Plain-English summary
A kiosk iPad app version 4.0.4 may expose visitor/contact details stored in contact.json to someone with local access to the device. The business risk is privacy exposure of names, phone numbers, and emails, not system takeover.
Executive priority
Treat as a targeted privacy exposure issue for affected reception deployments. It is not internet-scale, but exposed contact data on public-facing iPads can create reputational and compliance concerns.
Technical view
CVE-2018-17502 affects Los Trigos The Receptionist for iPad 4.0.4. Sources describe an error in contact.json enabling local information disclosure of contact names, phone numbers, and emails. CVSS 3.0 is 4.0 with local attack vector and low confidentiality impact.
Likely exposure
Exposure is likely limited to organizations still running The Receptionist for iPad 4.0.4 on deployed iPads, especially lobby or shared tablets with weak physical control.
Exploitation context
The provided sources do not indicate active exploitation, and the CVE is not listed as KEV. Exploitation requires local access to the affected iPad context.
Researcher notes
Evidence is sparse: the public description names contact.json and exposed contact fields but does not provide implementation detail, exploit status, or explicit patch information. Avoid assuming broader versions are affected.
Mitigation direction
- Inventory iPads running The Receptionist for iPad and identify version 4.0.4.
- Check vendor guidance for fixed versions or configuration changes.
- Update or replace affected installations where vendor remediation is available.
- Restrict physical access to reception iPads until remediation is confirmed.
- Review exposed contact data for privacy or notification obligations internally.
Validation and detection
- Confirm installed app version on each reception iPad.
- Verify whether contact names, phone numbers, or emails are stored locally in contact.json.
- Check vendor release notes or support channels for remediation status.
- After remediation, confirm the vulnerable data exposure path is no longer present.
- Document affected locations, device owners, and remediation evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-17502 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/PR:N/A:N/AV:L/I:N/S:U/UI:N/AC:L/C:L/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/PR:N/A:N/AV:L/I:N/S:U/UI:N/AC:L/C:L/E:U/RL:O/RC:C2.51.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
4MediumVector: CVSS:3.0/PR:N/A:N/AV:L/I:N/S:U/UI:N/AC:L/C:L/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- receptionist-contacts-cve201817502-info-disc (149662)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.