CVE-2014-2019

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-02-18 · updated 2026-06-17
Weakness: CWE-264

Description

The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value.

Affected products

Apple Iphone Os: before 7.1 — fixed in 7.1

How to fix

Upgrade to a fixed version: Apple Iphone Os 7.1. Check the vendor advisory for mitigations.

References

http://news.softpedia.com/news/Major-iOS-7-Security-Flaw-Discovered-Video-425011.shtml
http://support.apple.com/kb/HT6162
http://www.youtube.com/watch?v=QnPk4RRWjic
http://news.softpedia.com/news/Major-iOS-7-Security-Flaw-Discovered-Video-425011.shtml
http://support.apple.com/kb/HT6162
http://www.youtube.com/watch?v=QnPk4RRWjic

Get alerted when CVE-2014-2019 or the next vulnerability affects your stack