Code injection in Apple SecureROM
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.
Summary
A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devices. This vulnerability allows arbitrary code to be executed on the device. Exploiting the vulnerability requires physical access to the device: the device must be plugged in to a computer upon booting, and it must be put into Device Firmware Update (DFU) mode. The exploit is not persistent; rebooting the device overrides any changes to the device's software that were made during an exploited session on the device. Additionally, unless an attacker has access to the device's unlock PIN or fingerprint, an attacker cannot gain access to information protected by Apple's Secure Enclave or Touch ID features.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apple | SecureROM | A5 – A11 | — | No fix listed | CNA |
- SecureROM VendorApple Affected A5 – A11 Fixed in — No fix listed CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:apple:securerom:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Apple |
| cpe:2.3:h:apple:a10_fusion:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:h:apple:a10x_fusion:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:h:apple:a11_bionic:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:h:apple:a5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:h:apple:a5x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:h:apple:a6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:h:apple:a6x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:h:apple:a7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:h:apple:a8:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
- cpe:2.3:o:apple:securerom:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apple
- cpe:2.3:h:apple:a10_fusion:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:h:apple:a10x_fusion:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:h:apple:a11_bionic:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:h:apple:a5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:h:apple:a5x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:h:apple:a6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:h:apple:a6x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:h:apple:a7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:h:apple:a8:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-8900
- 2026-10-03 Alias added: GHSA-rq4h-cqfg-pj23
References
Advisory 1
Sources
- CVE-2019-8900 · CVE Program
- CVE-2019-8900 · NVD
- FIRST EPSS
- GHSA-rq4h-cqfg-pj23 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences