Logic Flaw in iOS Bluetooth PAN Stack Enables Zero‑Cost Ethernet Gateway Over Bluetooth
What Happened — A publicly disclosed logic flaw in Apple’s iOS Bluetooth PAN implementation lets an attacker open the device’s internal USB port 62078 over Bluetooth, causing the iPhone to display a real “Ethernet” icon and maintain the connection after reboot or password change. The exploit requires no physical adapter and works on iOS 17 and later.
Why It Matters for Compliance & Audit Readiness
- The scenario illustrates a classic control‑gap: lack of continuous monitoring for unauthorized peripheral activation, a gap SOC 2 CC6 (System Operations) expects you to detect and log.
- Demonstrates the need for evidence‑driven endpoint‑security controls (e.g., Bluetooth policy enforcement, USB‑port usage monitoring) that can be continuously collected for audit purposes.
- Aligns with Verisq’s Control Mapping capability, which helps map such technical findings to SOC 2 controls and provides continuous evidence to prove remediation.
Who Is Affected — Consumer‑grade iOS devices across all sectors (tech, finance, healthcare, etc.) that enable Bluetooth PAN.
Recommended Actions
- Update Bluetooth PAN usage policies to require explicit user consent and restrict background activation.
- Deploy continuous monitoring agents that log Bluetooth connections and USB‑port activity, mapping logs to SOC 2 CC6.
- Validate that patch management processes capture logic‑flaw remediation (even when Apple does not assign a CVE). Source: Exploit‑DB 52618
Technical Notes
- Attack vector: VULNERABILITY_EXPLOIT via Bluetooth PAN (remote, no credentials).
- No CVE assigned; Apple closed the case without a CVE.
- Affected versions: iOS 17 and later; tested on iPhone 14 Pro (iOS 17.5.1) and macOS Ventura 13.6. Source: GitHub PoC