LiveActive security incident?Get immediate response
CVE Record

CVE-2019-4735: IBM MaaS360 3.96.62 for iOS could allow an attacker with physical access to the device to obtain sensitive...

IBM MaaS360 3.96.62 for iOS could allow an attacker with physical access to the device to obtain sensitive information from the agent outside of the container. IBM X-Force ID: 172705.

LowCVSS 2.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takelow

Analyst readout for executives and security teams

Plain-English summary

IBM MaaS360 3.96.62 for iOS could expose sensitive information from the management agent outside its protected container. The risk is limited because an attacker needs physical access to the device, but lost, stolen, or shared devices could still create exposure.

Executive priority

Treat this as a low-priority remediation unless your environment has high device loss risk or sensitive mobile workflows. It is not a remote compromise issue based on the provided evidence.

Technical view

CVE-2019-4735 affects IBM MaaS360 for iOS version 3.96.62. The CVSS 3.0 score is 2.4, with physical attack vector, low attack complexity, no privileges, no user interaction, and low confidentiality impact only.

Likely exposure

Exposure is likely limited to organizations running IBM MaaS360 3.96.62 on iOS devices, especially where devices may be lost, stolen, shared, or left unlocked.

Exploitation context

The provided sources do not cite active exploitation, and the CVE is not listed as CISA KEV. The CVSS vector indicates physical access is required and exploit maturity was unproven.

Researcher notes

The public bundle does not identify a CWE or describe the exact information exposed. Impact is confidentiality-only, scope unchanged, with no integrity or availability impact indicated.

Mitigation direction

  • Check IBM guidance for the fixed or recommended MaaS360 iOS agent version.
  • Update affected iOS MaaS360 agents according to IBM’s advisory.
  • Prioritize remediation for lost-device-prone or shared-device populations.
  • Maintain strong device lock, encryption, and remote-wipe controls.
  • Review container and agent data handling policies with the vendor.

Validation and detection

  • Inventory iOS devices running IBM MaaS360 agent version 3.96.62.
  • Confirm current agent versions through MDM or app deployment records.
  • Verify remediation status against IBM Support and X-Force guidance.
  • Review incident records for lost or physically accessed managed devices.
  • Document whether sensitive data could exist outside the managed container.
Prepared
Confidence
high
Sources
4

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-4735 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.4 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/PR:N/AC:L/AV:P/S:U/C:L/A:N/I:N/UI:N/RC:C/RL:O/E:U

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.4CVSS 3.0LowCVSS:3.0/PR:N/AC:L/AV:P/S:U/C:L/A:N/I:N/UI:N/RC:C/RL:O/E:U0.91.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

2.4Low
CVSS 3.0 vector shape for CVE-2019-4735Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/PR:N/AC:L/AV:P/S:U/C:L/A:N/I:N/UI:N/RC:C/RL:O/E:U

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMMaaS3603.96.62Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.