While the first HomeView units won’t reach customers until tomorrow, Apple today released a software update addressing nine security vulnerabilities. Here are the details.
Apple today released HomeView Software Version 27.2 (build 24V526), which contains some of the security fixes the company included in recent updates to its other operating systems, including iOS 27.2, macOS 27.2 Golden Gate, and iPadOS 27.2.
These include a vulnerability that could allow a remote attacker to join an iMessage group chat and receive its messages, as well as another that could allow a malicious Bluetooth device to pair without user interaction.
In practice, this means that users who get the device starting tomorrow are advised to update it as soon as possible, since the vulnerabilities have been publicly disclosed.
Here’s the full security content of HomeView Software Version 27.2
Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts
Description: A logic issue was addressed with improved state management.
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state management.
Impact: An attacker in Bluetooth range may be able to corrupt process memory
Description: A use-after-free issue was addressed with improved memory management.
Impact: Processing maliciously crafted input may lead to memory corruption
Description: An out-of-bounds write issue was addressed with improved input validation.
Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction
Description: This issue was addressed with improved checks.
Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction
Description: A logic issue was addressed with improved state management.
Impact: A remote attacker may be able to join an iMessage group chat and receive its messages
Description: An authorization issue was addressed with improved validation.
Impact: A user added to an iMessage group may be able to access messages sent before they joined
Description: This issue was addressed by removing the vulnerable code.
Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts
Description: A logic issue was addressed with improved state management.
Earlier today, Apple also confirmed that a software update coming next month will add support for security accessories to HomeView’s Siri AI, which currently refuses to unlock doors or open garage doors via voice commands.
Be sure to catch 9to5Mac’s full review of Apple HomeView ahead of tomorrow’s launch.
FTC: We use income earning auto affiliate links. More.
Check out 9to5Mac on YouTube for more Apple news:
Marcus Mendes is a Brazilian tech podcaster and journalist who has been closely following Apple since the mid-2000s.
