LiveActive security incident?Get immediate response
CVE Record

CVE-2022-32835: This issue was addressed with improved entitlements.

This issue was addressed with improved entitlements. This issue is fixed in iOS 16, watchOS 9. An app may be able to read a persistent device identifier.

LowCVSS 3.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Apple vulnerability could let an app read a persistent device identifier on affected iPhone or Apple Watch devices. That is a privacy and tracking concern, not a system takeover issue. Apple says it was fixed by improving entitlements in iOS 16 and watchOS 9.

Executive priority

Handle through normal mobile patch governance. The business risk is privacy exposure and potential tracking, not service disruption or remote compromise. Prioritize devices used for sensitive work or regulated data.

Technical view

CVE-2022-32835 is a CWE-200 information exposure issue. Apple describes the impact as an app being able to read a persistent device identifier. The CVSS 3.1 score is 3.3, with local access, low complexity, no privileges, user interaction, and low confidentiality impact.

Likely exposure

Exposure is limited to Apple iOS and watchOS devices below the fixed releases, but the sources do not specify exact affected version ranges. This is endpoint privacy exposure, not an internet-facing service risk.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The CVSS vector indicates local exploitation with user interaction, consistent with a device app context.

Researcher notes

Apple’s public description is sparse: affected versions are unspecified, and the persistent identifier is not named. Treat validation as version-based unless Apple or device telemetry provides more detail. Do not infer exploit maturity beyond the provided CVSS and KEV status.

Mitigation direction

  • Update eligible iPhones to iOS 16 or later.
  • Update eligible Apple Watch devices to watchOS 9 or later.
  • Check Apple guidance for unsupported devices or additional security update notes.
  • Use MDM reporting to track mobile operating system compliance.

Validation and detection

  • Inventory iOS and watchOS versions across managed devices.
  • Confirm devices are on iOS 16, watchOS 9, or later.
  • Identify unmanaged or unsupported Apple devices that cannot receive the fixed release.
  • Review mobile app governance for apps with unnecessary device identifier access.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-200: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-32835 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
3.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
3.3CVSS 3.1LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N1.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

3.3Low
CVSS 3.1 vector shape for CVE-2022-32835Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
AppleiOSunspecifiedListed
ApplewatchOSunspecifiedListed
Weakness

CWE details

CWE-200

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-200 · source CWE mapping

Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs