CVE-2018-4298

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-11 · updated 2026-06-17

Description

In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a permissions issue existed in Remote Management. This issue was addressed through improved permission validation.

Affected products

Apple TV: before 11.2.5 — fixed in 11.2.5
Apple Iphone Os: before 11.2.5 — fixed in 11.2.5
macOS: from 10.13.0 before 10.13.3 — fixed in 10.13.3
Apple watchOS: before 4.2.2 — fixed in 4.2.2

How to fix

Upgrade to a fixed version: Apple TV 11.2.5; Apple Iphone Os 11.2.5; macOS 10.13.3; Apple watchOS 4.2.2. Check the vendor advisory for mitigations.

References

https://support.apple.com/HT208465
https://support.apple.com/HT208692%2C
https://support.apple.com/HT208465
https://support.apple.com/HT208692%2C

Get alerted when CVE-2018-4298 or the next vulnerability affects your stack