Back
CVE-2017-14315
In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP (Low Energy Audio Protocol), a large audio command can be…
High7.5EPSS 1.00%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP (Low Energy Audio Protocol), a large audio command can be sent to a targeted device and lead to a heap overflow with attacker-controlled data. Since the audio commands sent via LEAP are not properly validated, an attacker can use this overflow to gain full control of the device through the relatively high privileges of the Bluetooth stack in iOS. The attack bypasses Bluetooth access control; however, the default "Bluetooth On" value must be present in Settings.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.5 | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.00% · top 37% of all CVEs (5 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
n/a
- affected n/a
References (5)
- 100816 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://www.armis.com/blueborne (opens in a new tab)x_refsource_MISCx_transferred
- 20190513 APPLE-SA-2019-5-13-6 Apple TV Software 7.3 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- https://support.apple.com/kb/HT210121 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 20190514 APPLE-SA-2019-5-13-6 Apple TV Software 7.3 (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-14315)Record last updated .