Security readout for executives and security teams
Plain-English summary
CVE-2018-4380 is an iOS lock-screen privacy flaw. On affected devices, someone with access to a locked device could reach photos and contacts. Apple says the issue affected iOS versions before 12.0.1 and was fixed by restricting options available while locked.
Executive priority
Treat this as a privacy and device-management issue, not a broad network compromise risk. Remediate remaining legacy iOS devices, especially where lost, shared, or physically accessible devices could expose sensitive contacts or photos.
Technical view
The source describes an improper lock-screen state issue in iOS before 12.0.1. The impact is unauthorized local access to photos and contacts from a locked device. No CVSS score, CWE, exploit details, or broader affected Apple products are provided in the supplied sources.
Likely exposure
Exposure is most likely on legacy iOS devices that remain below iOS 12.0.1, especially unmanaged or forgotten devices with local physical access risk.
Exploitation context
The supplied sources do not show active exploitation, and the CVE is not listed as KEV. The described access requires interaction with a locked device; no remote attack vector is stated.
Researcher notes
The source bundle is sparse: no CVSS, CWE, proof-of-concept status, or detailed root cause is provided. Analysis should stay limited to Apple’s statement: lock-screen access to photos and contacts before iOS 12.0.1, fixed by restricting locked-device options.
Mitigation direction
- Update affected iOS devices to iOS 12.0.1 or later.
- Prioritize legacy or unmanaged devices that may remain below iOS 12.0.1.
- Check Apple’s advisory for any environment-specific guidance.
- Use device management inventory to identify outdated iOS versions.
Validation and detection
- Confirm all in-scope iOS devices report version 12.0.1 or later.
- Review MDM or asset inventory for devices below iOS 12.0.1.
- Verify exception lists for unsupported or retired devices.
- Document remediation status for any device that cannot be updated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-4380 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/HT209162CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.