PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2371 Apple CVE debrief

CVE-2017-2371 describes a WebKit issue in Apple iOS before 10.2.1 that let a remote attacker use a crafted website to launch popups. NVD assigns the issue a medium severity score and identifies user interaction as part of the attack path.

Vendor
Apple
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Organizations and individuals running iOS devices on versions earlier than 10.2.1 should care, especially anyone responsible for device patching, fleet compliance, or browser-facing risk reduction.

Technical summary

The vulnerability is recorded against Apple iPhone OS/iOS versions before 10.2.1 and affects the WebKit component. According to NVD, the attack is network-reachable, requires no privileges, and depends on user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). The published description states that a crafted website can be used to launch popups.

Defensive priority

Medium. The issue is remote and user-interaction driven, but the affected scope is limited to older iOS releases and the remedy is straightforward patching to 10.2.1 or later.

Recommended defensive actions

  • Update affected iOS devices to 10.2.1 or later.
  • Inventory devices still running pre-10.2.1 iOS and prioritize them for remediation.
  • Treat unpatched legacy iOS devices as higher risk until they are upgraded or removed from service.

Evidence notes

Evidence is drawn from the CVE record, NVD metadata, and the linked Apple advisory reference. The source corpus identifies the affected platform as iOS before 10.2.1, the component as WebKit, and the attack as a crafted website that launches popups. No exploit steps or additional impact claims are included beyond the supplied metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-2371 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-2371

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-2371 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-2371

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.