CVE-2024-0230

A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.0.6. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/120303
https://support.apple.com/en-us/HT214050	Release Notes Third Party Advisory
https://support.apple.com/kb/HT214050

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:apple:magic_keyboard_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:apple:magic_keyboard:-:*:*:*:*:*:*:*

History

02 Apr 2026, 19:16

Type	Values Removed	Values Added
References		() https://support.apple.com/en-us/120303 -

04 Nov 2025, 19:16

Type	Values Removed	Values Added
References		() https://support.apple.com/kb/HT214050 -

21 Nov 2024, 08:46

Type	Values Removed	Values Added
References	~~() https://support.apple.com/en-us/HT214050 - Release Notes, Third Party Advisory~~	() https://support.apple.com/en-us/HT214050 - Release Notes, Third Party Advisory

19 Jan 2024, 18:35

Type	Values Removed	Values Added
References	~~() https://support.apple.com/en-us/HT214050 -~~	() https://support.apple.com/en-us/HT214050 - Release Notes, Third Party Advisory
First Time		Apple magic Keyboard Apple Apple magic Keyboard Firmware
CPE		cpe:2.3:h:apple:magic_keyboard:-:::::::* cpe:2.3:o:apple:magic_keyboard_firmware::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 2.4
CWE		NVD-CWE-noinfo

12 Jan 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-12 23:15

Updated : 2026-04-02 19:16

NVD link : CVE-2024-0230

Mitre link : CVE-2024-0230

CVE.ORG link : CVE-2024-0230

JSON object : View

Products Affected

apple

magic_keyboard
magic_keyboard_firmware

CWE

NVD-CWE-noinfo

{"id": "CVE-2024-0230", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "published": "2024-01-12T23:15:08.847", "references": [{"url": "https://support.apple.com/en-us/120303", "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/HT214050", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT214050", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.0.6. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic."}, {"lang": "es", "value": "Se solucion\u00f3 un problema de gesti\u00f3n de sesiones con comprobaciones mejoradas. Este problema se solucion\u00f3 en la actualizaci\u00f3n de Magic Keyboard Firmware 2.0.6. Un atacante con acceso f\u00edsico al accesorio puede extraer su clave de emparejamiento de Bluetooth y monitorear el tr\u00e1fico de Bluetooth."}], "lastModified": "2026-04-02T19:16:53.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:magic_keyboard_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "643DF5A4-035B-426F-AC1B-CC0DFFB82C47", "versionEndExcluding": "2.0.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:apple:magic_keyboard:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B501279A-4B87-4E15-A6C7-07EB88491878"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "product-security@apple.com"}