CVE-2022-48575: macOS Login Window Bypass via State Handling Flaw

Technical summary

This vulnerability is rooted in a state management flaw in macOS's Login Window component (CWE-287: Improper Authentication). The attack vector is physical (AV:P), meaning an attacker must have in-person access to the device. The vulnerability exploits a consistency issue where the Login Window's security state is not properly maintained or verified across transitions, creating a narrow window for bypass. The low CVSS score (3.5) reflects the physical access requirement and limited impact scope (confidentiality and integrity only; no availability impact).

Business impact

The practical risk is confined to organizations with heightened physical security threats—such as those in high-security facilities, shared workspaces, or environments where unattended Macs may be left accessible. A threat actor with desk-side access could potentially access user data or modify system settings without authentication. For most enterprises with standard office security, the impact is minimal, but financial services, healthcare, and defense sectors should treat this more seriously. The vulnerability does not enable remote exploitation, significantly limiting its business scope.

Affected systems

Apple macOS systems prior to Monterey 12.4 are vulnerable. This includes Monterey 12.0 through 12.3 and potentially earlier macOS versions, though Apple's description specifically references the Monterey 12.4 fix. Organizations running Monterey, Big Sur, or older versions should prioritize verification and patching. The vulnerability does not affect iOS, iPadOS, or other Apple platforms based on the available information.

Exploitability

Exploitability is low in real-world attack scenarios. An attacker must be physically present at an unlocked or minimally secured Mac, then execute the bypass during a narrow state transition window. There is no indication of a public exploit, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild is either absent or minimal. The fix has been available since mid-2022, allowing ample time for patching.

Remediation

Update macOS Monterey to version 12.4 or later. Users on earlier macOS versions (Big Sur, Catalina) should check Apple's security bulletins for equivalent patches or plan upgrades accordingly. Beyond patching, enforce physical security controls: require attendants to lock their machines when away, disable auto-login, and configure firmware password protection. These compensating controls significantly reduce attack surface even if systems remain unpatched.

Patch guidance

Apply macOS Monterey 12.4 or any subsequent security update released by Apple. Users can verify their version by clicking the Apple menu > About This Mac > System Report and checking the macOS version. Automatic updates should be enabled in System Preferences > General > Software Update to ensure timely delivery of future security patches. Organizations managing multiple Macs should deploy patches via MDM or similar configuration management tools to ensure consistent coverage.

Detection guidance

Detection is challenging because the vulnerability exploits a transient state inconsistency. Focus on preventive measures: log and monitor failed Login Window events via system logs (Console.app or /var/log/system.log), though the bypass may not generate obvious error messages. Implement endpoint detection and response (EDR) solutions to flag unusual authentication patterns or state anomalies. Physical security monitoring (camera, access logs) is more practical than technical detection for this threat vector. Regular configuration audits to verify firmware passwords and login policies are enabled can help catch systems at risk.

Why prioritize this

This vulnerability merits medium-low prioritization. The physical access requirement drastically reduces enterprise risk compared to remote exploits. However, organizations with valuable IP, regulated data, or high-profile personnel should prioritize patching sooner, as targeted physical attacks are plausible in those contexts. The age of the vulnerability (patch available since 2022) and lack of KEV status suggest it has not been actively weaponized, further lowering urgency for most organizations.

Risk score, explained

The CVSS 3.1 score of 3.5 (LOW) reflects the authentication bypass nature of the flaw, but the physical access vector (AV:P) is the dominant limiting factor. If this were remotely exploitable, the score would be significantly higher. The Low Complexity (AC:L) and No Privileges Required (PR:N) components indicate that execution is straightforward once physical access is obtained, but that prerequisite substantially constrains real-world applicability. Confidentiality and Integrity impacts are partial (not complete compromise), which also keeps the severity bounded.

Frequently asked questions