Security News > 2023 > September > CISA warns govt agencies to secure iPhones against spyware attacks

CISA warns govt agencies to secure iPhones against spyware attacks
2023-09-11 16:21

The U.S. Cybersecurity and Infrastructure Security Agency ordered federal agencies today to patch security vulnerabilities abused as part of a zero-click iMessage exploit chain to infect iPhones with NSO Group's Pegasus spyware.

On Monday, CISA added the two security flaws to its Known Exploited Vulnerabilities catalog, tagging them as "Frequent attack vectors for malicious cyber actors" and posing "Significant risks to the federal enterprise."

Federal agencies must secure all vulnerable iOS, iPadOS, and macOS devices on their networks against CVE-2023-41064 and CVE-2023-41061 by October 2nd, 2023.

While BOD 22-01 primarily focuses on U.S. federal agencies, CISA also strongly advised private companies to prioritize patching the two vulnerabilities as soon as possible.

Apple zero-click iMessage exploit used to infect iPhones with spyware.

CISA issues new warning on actively exploited Ivanti MobileIron bugs.


News URL

https://www.bleepingcomputer.com/news/security/cisa-warns-govt-agencies-to-secure-iphones-against-spyware-attacks/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2023-09-07 CVE-2023-41064 Classic Buffer Overflow vulnerability in Apple Ipados and Iphone OS
A buffer overflow issue was addressed with improved memory handling.
local
low complexity
apple CWE-120
7.8
2023-09-07 CVE-2023-41061 Unspecified vulnerability in Apple Ipados
A validation issue was addressed with improved logic.
local
low complexity
apple
7.8