CVE-2024-23250: 
macOS vulnerability analysis and mitigation

CVE-2024-23250 is a security vulnerability discovered in Apple's operating systems affecting tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, and watchOS 10.4. The vulnerability was disclosed on March 7, 2024, and relates to an access issue in the CoreBluetooth - LE component that could allow an app to access Bluetooth-connected microphones without user permission (Apple Advisory).

The vulnerability is an access control issue in the CoreBluetooth - LE component that was addressed with improved access restrictions. It has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

The vulnerability could allow a malicious application to bypass user permission controls and gain unauthorized access to Bluetooth-connected microphones, potentially compromising user privacy (Apple Advisory).

The vulnerability requires local access and user interaction to be exploited. There are no reports of this vulnerability being exploited in the wild (NVD).

Apple has addressed this vulnerability by implementing improved access restrictions in the following software updates: tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, and watchOS 10.4. Users are advised to update their devices to these versions to protect against potential exploitation (Apple Advisory).

The vulnerability was discovered and reported by Guilherme Rambo of Best Buddy Apps (rambo.codes), demonstrating ongoing security research efforts in the Apple ecosystem (Apple Advisory).