CVE-2009-2796: Apple iPhone OS

Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The UIKit component in Apple iPhone OS 3.0, and iPhone OS 3.0.1 for iPod touch, allows physically proximate attackers to discover a password by watching a user undo deletions of characters in the password.

Affected products

• Apple iPhone OS: version 3.0 only; version 3.0.1 only

Published 2009-09-10. Last modified 2026-06-16.