PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4670 Apple CVE debrief

CVE-2016-4670 is a low-severity Apple information-disclosure issue in the Security component. According to the NVD and Apple advisories, a local user could read a log and learn the length of arbitrary passwords. The issue was fixed in iOS 10.1 and macOS 10.12.1. This does not indicate direct password disclosure or remote compromise, but it can still aid local reconnaissance and account-targeting efforts.

Vendor
Apple
Product
Unknown
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Apple device administrators, endpoint security teams, and users of affected iPhone/iPad and Mac systems should care, especially where local account access or shared access to logs is possible.

Technical summary

NVD describes the flaw as a local information leak with CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability affects iOS versions before 10.1 and macOS versions before 10.12.1, with NVD CPE ranges showing iPhone OS through 10.0.3 and macOS through 10.12.0. The disclosure appears limited to password length information obtained by reading a log; no integrity or availability impact is indicated in the supplied sources.

Defensive priority

Low. Patch promptly on any still-supported or unpatched Apple systems, but this issue is primarily an information disclosure rather than a direct compromise path.

Recommended defensive actions

  • Update iOS devices to 10.1 or later.
  • Update macOS systems to 10.12.1 or later.
  • Review whether local users can access relevant logs or log exports on shared systems.
  • Apply least-privilege controls to local accounts and administrative access.
  • Reduce unnecessary log exposure and retention where operationally feasible.
  • Confirm fleet compliance against the affected version ranges in the advisory.

Evidence notes

The description and version bounds come from the supplied CVE record and NVD metadata: iOS before 10.1 and macOS before 10.12.1. NVD’s CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, consistent with a local confidentiality-only issue. The source corpus includes Apple vendor advisories (support.apple.com/HT207271 and support.apple.com/HT207275) and a SecurityFocus reference, but no exploit details beyond log-based password-length disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-4670 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-4670

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-4670 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-4670

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.