CVE-2020-3917

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-01 · updated 2026-06-17

Description

This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application may be able to use an SSH client provided by private frameworks.

Affected products

Apple iPadOS: before 13.4 — fixed in 13.4
Apple Iphone Os: before 13.4 — fixed in 13.4
Apple tvOS: before 13.4 — fixed in 13.4
Apple watchOS: before 6.2 — fixed in 6.2

How to fix

Upgrade to a fixed version: Apple iPadOS 13.4; Apple Iphone Os 13.4; Apple tvOS 13.4; Apple watchOS 6.2. Check the vendor advisory for mitigations.

References

https://support.apple.com/HT211101
https://support.apple.com/HT211102
https://support.apple.com/HT211103
https://support.apple.com/HT211101
https://support.apple.com/HT211102
https://support.apple.com/HT211103

Get alerted when CVE-2020-3917 or the next vulnerability affects your stack