CVE-2020-9802 – This is a critical logic vulnerability in Apple... (How to Fix)

Q: What is the severity of CVE-2020-9802?

CVE-2020-9802 has a CVSS score of 8.8 (HIGH). This is a critical logic vulnerability in Apple's WebKit browser engine that allows arbitrary code execution when processing malicious web content. Attackers can craft malicious websites that exploit this flaw to run arbitrary code on affected devices. The vulnerability affects multiple Apple platforms including iOS, iPadOS, tvOS, watchOS, Safari, and iCloud/ITunes for Windows.

📋 TL;DR

This is a critical logic vulnerability in Apple's WebKit browser engine that allows arbitrary code execution when processing malicious web content. Attackers can craft malicious websites that exploit this flaw to run arbitrary code on affected devices. The vulnerability affects multiple Apple platforms including iOS, iPadOS, tvOS, watchOS, Safari, and iCloud/ITunes for Windows.

💻 Affected Systems

Products:

iOS
iPadOS
tvOS
watchOS
Safari
iTunes for Windows
iCloud for Windows

Versions: Versions prior to iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7, iCloud for Windows 11.2/7.19

Operating Systems: iOS, iPadOS, tvOS, watchOS, Windows

Default Config Vulnerable: ⚠️ Yes

Notes: All default configurations are vulnerable. The vulnerability exists in WebKit, which is used across multiple Apple products.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing attackers to execute arbitrary code with the privileges of the current user, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.

🟠

Likely Case

Drive-by compromise where users visit malicious websites leading to malware installation, credential theft, or device takeover.

🟢

If Mitigated

Limited impact with proper network segmentation, application whitelisting, and user education preventing access to malicious sites.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires user interaction (visiting malicious website) but no authentication. The logic issue suggests moderate technical complexity for exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7, iCloud for Windows 11.2/7.19

Vendor Advisory: https://support.apple.com/HT211168

Restart Required: Yes

Instructions:

1. For iOS/iPadOS: Go to Settings > General > Software Update and install iOS 13.5 or later. 2. For macOS: Update Safari via System Preferences > Software Update. 3. For Windows: Update iTunes via Microsoft Store or Apple Software Update. 4. For iCloud for Windows: Update via Microsoft Store or Apple Software Update. 5. Restart devices after installation.

🔧 Temporary Workarounds

Browser Restrictions

all

Restrict browser usage to trusted sites only and implement web content filtering.

Network Segmentation

all

Segment affected devices from critical network resources to limit lateral movement.

🧯 If You Can't Patch

Implement strict web content filtering to block access to untrusted websites
Deploy application whitelisting to prevent execution of unauthorized binaries

🔍 How to Verify

Check if Vulnerable:

Check current version against affected versions list. For iOS: Settings > General > About > Version. For Safari: Safari > About Safari.

Check Version:

iOS: Settings > General > About; macOS: Safari > About Safari; Windows: Help > About in iTunes/iCloud

Verify Fix Applied:

Verify version numbers match or exceed patched versions: iOS/iPadOS 13.5+, tvOS 13.4.5+, watchOS 6.2.5+, Safari 13.1.1+, iTunes 12.10.7+, iCloud for Windows 11.2/7.19+.

📡 Detection & Monitoring

Log Indicators:

Unexpected browser crashes
Suspicious process creation from browser processes
Unusual network connections from browser

Network Indicators:

Connections to known malicious domains
Unusual outbound traffic patterns from affected devices

SIEM Query:

source="browser_logs" AND (event="crash" OR process="unexpected_executable")

📊 Metadata

CVE ID: CVE-2020-9802

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published: June 9, 2020

Last Updated: May 5, 2025

🔗 References

https://support.apple.com/HT211168 Release Notes,Vendor Advisory
https://support.apple.com/HT211171 Release Notes,Vendor Advisory
https://support.apple.com/HT211175 Release Notes,Vendor Advisory
https://support.apple.com/HT211177 Broken Link,Release Notes,Vendor Advisory
https://support.apple.com/HT211178 Release Notes,Vendor Advisory
https://support.apple.com/HT211179 Release Notes,Vendor Advisory
https://support.apple.com/HT211181 Release Notes,Vendor Advisory
https://support.apple.com/HT211168 Release Notes,Vendor Advisory
https://support.apple.com/HT211171 Release Notes,Vendor Advisory
https://support.apple.com/HT211175 Release Notes,Vendor Advisory
https://support.apple.com/HT211177 Broken Link,Release Notes,Vendor Advisory
https://support.apple.com/HT211178 Release Notes,Vendor Advisory
https://support.apple.com/HT211179 Release Notes,Vendor Advisory
https://support.apple.com/HT211181 Release Notes,Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON