Insufficient session expiration in Apple watchOS
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-613.
Summary
An issue in the handling of group membership was resolved with improved logic. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12.1. A malicious user may be able to leave a messages group but continue to receive messages in that group.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apple | watchOS | before 8.3 | 8.3 | Patch available | CNA |
| Apple | watchOS | before 15.2 | 15.2 | Patch available | CNA |
| Apple | watchOS | before 12.1 | 12.1 | Patch available | CNA |
- watchOS VendorApple Affected before 8.3 Fixed in 8.3 Patch available CNA
- watchOS VendorApple Affected before 15.2 Fixed in 15.2 Patch available CNA
- watchOS VendorApple Affected before 12.1 Fixed in 12.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | before 15.2 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | before 15.2 | Vulnerable | Apple |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | 12.0.0 to before 12.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | before 8.3 | Vulnerable | Apple |
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 15.2 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 15.2 Vulnerable ·Apple
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.1 Vulnerable ·Apple
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* Versions before 8.3 Vulnerable ·Apple
Remediation
- Fix · CNA watchOS (Apple) Fixed in 8.3
- Fix · CNA watchOS (Apple) Fixed in 15.2
- Fix · CNA watchOS (Apple) Fixed in 12.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apple watchOS 8.3
22 records Highest priority Priority MEDIUM 3 MEDIUM, 19 LOW
Other records, highest priority first
- TI-2021-11304 Out-of-bounds write in Apple watchOSPriority MEDIUM 51
- TI-2021-11306 Out-of-bounds read in Apple watchOSPriority MEDIUM 41
- TI-2021-11357 Buffer overflow in Apple watchOSPriority MEDIUM 40
- Release ·
Apple watchOS 12.1
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2021-11370 Incorrect default permissions in Apple iOS and iPadOSPriority LOW 26
- TI-2021-11311 Apple watchOS: A malicious app may be able to access data from other apps by enabling…Priority LOW 26
- TI-2021-11364 Incorrect default permissions in Apple watchOSPriority LOW 17
Show 1 more group
- Release ·
Apple watchOS 15.2
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-11311 Apple watchOS: A malicious app may be able to access data from other apps by enabling…Priority LOW 26
- TI-2021-11364 Incorrect default permissions in Apple watchOSPriority LOW 17
Timeline
- 2026-10-02 Threatist record created from CVE-2021-30943
References
More Apple Ipados vulnerabilities
- TI-2025-28008 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
- TI-2025-22441 Apple iOS and iPadOS: An attacker with arbitrary read and write capability may be able to… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-22440 Memory corruption in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
- TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
- TI-2025-17847 Use after free in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
- TI-2022-06854 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences