Apple Remote Desktop vulnerabilities

6 CVEs affecting Apple Remote Desktop, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-5229, published 2015-11-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-5135, published 2013-10-24. High severity, CVSS 7.5. EPSS: 10.8% chance of exploitation in the next 30 days. Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10.9 and Apple Remote Desktop before 3.5.4 allows remote attackers to execute arbitrary code via format string specifiers…
CVE-2004-0962, published 2005-02-09. High severity, CVSS 10.0. EPSS: 3.4% chance of exploitation in the next 30 days. Apple Remote Desktop Client 1.2.4 executes a GUI application as root when it is started by an Apple Remote Desktop Administrator application, which allows remote authenticated users to execute…
CVE-2012-0681, published 2012-08-22. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Apple Remote Desktop before 3.6.1 does not recognize the "Encrypt all network data" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC…
CVE-2013-5136, published 2013-10-24. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Apple Remote Desktop before 3.7 does not properly use server authentication-type information during decisions about whether to present an unencrypted-connection warning message, which allows remote…
CVE-2006-4887, published 2006-09-19. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. Apple Remote Desktop (ARD) for Mac OS X 10.2.8 and later does not drop privileges on the remote machine while installing certain applications, which allows local users to bypass authentication and…
CVE-2013-5229, published 2015-11-14. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Remote Desktop full-screen feature in Apple OS X before 10.9 and Apple Remote Desktop before 3.7 sends dialog-box text to a connected remote host upon being woken from sleep, which allows…