CVE-2017-2404 is a high-severity vulnerability affecting Apple iOS versions prior to 10.3, specifically within the Quick Look component. This flaw allows remote attackers to initiate telephone calls to arbitrary numbers simply by embedding a "tel:" URL within a PDF document. The attack requires no user interaction and has a high impact on integrity, as it can force unwanted calls. This vulnerability was exploited in the wild in October 2016, indicating its active use by malicious actors. Despite its past exploitation, there are no publicly available exploit modules or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 10.2.1CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.