{"id":"CVE-2024-40840","state":"PUBLISHED","title":"This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to use Siri to access sensitiv","description":"This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to use Siri to access sensitive user data.","publishedAt":"2024-09-16T23:22:46.728Z","updatedAt":"2026-04-02T18:16:14.913Z","severity":{"score":4.6,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"apple","products":["Apple iOS and iPadOS"],"affected":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","status":"affected","lessThan":"18","versionType":"custom"}]}],"references":["https://support.apple.com/en-us/121250","http://seclists.org/fulldisclosure/2024/Sep/32"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/40xxx/CVE-2024-40840.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-40840","state":"PUBLISHED","datePublished":"2024-09-16T23:22:46.728Z","dateUpdated":"2026-04-02T18:16:14.913Z","assignerShortName":"apple","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateReserved":"2024-07-10T17:11:04.706Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to use Siri to access sensitive user data."}],"affected":[{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","status":"affected","lessThan":"18","versionType":"custom"}]}],"references":[{"url":"https://support.apple.com/en-us/121250"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"An attacker with physical access may be able to use Siri to access sensitive user data"}]}],"providerMetadata":{"shortName":"apple","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateUpdated":"2026-04-02T18:16:14.913Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-40840","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-17T19:54:52.110547Z"}}},{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.6,"attackVector":"PHYSICAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-25T16:20:44.260Z"}},{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2024/Sep/32"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T16:12:59.820Z"}}]}}}