CVE-2024-40809: 
macOS vulnerability analysis and mitigation

CVE-2024-40809 is a security vulnerability affecting multiple Apple operating systems including iOS, iPadOS, macOS, watchOS, and visionOS. The vulnerability was discovered and reported by an anonymous researcher and was fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8, macOS Monterey 12.7.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, visionOS 1.3, and macOS Sonoma 14.6, released on July 29, 2024 (Apple Support).

The vulnerability is a logic issue in the Shortcuts application that could allow a shortcut to bypass Internet permission requirements. The issue was addressed with improved checks in the affected operating systems. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows a shortcut to bypass Internet permission requirements, potentially enabling unauthorized access to network resources without proper user consent or system permissions (Apple Support).

The vulnerability requires local access to exploit and has low attack complexity. It requires low privileges and no user interaction to execute (NVD).

Apple has addressed this vulnerability by implementing improved checks in the affected operating systems. Users should update to iOS 16.7.9/iPadOS 16.7.9, macOS Ventura 13.6.8, macOS Monterey 12.7.6, iOS 17.6/iPadOS 17.6, watchOS 10.6, visionOS 1.3, or macOS Sonoma 14.6 to protect against this vulnerability (Apple Support).