PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← Back | CVE Intelligence Hub

CVE-2026-84636[Medium]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-84636.

Vendor
Apple
Product
iOS / iPadOS / watchOS / tvOS / visionOS
Affected versions
< iOS 27, < watchOS 27, < tvOS 27, < visionOS 27
Coverage Span
2026-10-27
Reports
1 related reports

Associated Reports & Timeline

1.
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
github.com | vulnerability | Medium | | Original ↗ | .md | #data-exposure | #github | #red-team | #api-security
Security researcher Jian Lee (@speedyfriend433) published a proof of concept for CVE-2026-84636, demonstrating an authorization and state management flaw across Apple operating systems. The PoC uses the SystemConfiguration framework's SCDynamicStore APIs to read sensitive Wi-Fi SSID, captive network parameters, and interface configurations without requiring the restricted Wi-Fi info entitlement or location permissions.
Why it matters: Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.