CVE-2014-4498

CVE-2014-4498, known as "Thunderstrike," is a firmware vulnerability affecting Apple OS X before version 10.10.2. It allows a physically proximate attacker to modify firmware during the EFI update process by using a Thunderbolt device containing malicious code in its Option ROM. The vulnerability has a CVSS score of 4.7, indicating a low severity, as it requires physical access and moderate attack complexity, with the primary impact being integrity compromise. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB, though it garnered some media attention and community discussion upon disclosure.