CVE-2023-42913 is a high severity (CVSS 8.8) state management flaw in macOS System Settings. Remote Login sessions may be able to obtain full disk access permissions. Apple fixed it in macOS Sonoma 14.2. Macs that allow Remote Login over SSH should be updated first.
What's affected
The record lists macOS as affected, fixed in macOS Sonoma 14.2. Apple's bulletin has the entry under System Settings, with the impact "Remote Login sessions may be able to obtain full disk access permissions" and the description "This issue was addressed through improved state management". Apple added the entry on March 22, 2024.
The weakness in the record is CWE-922, which covers sensitive resources stored or exposed in a way that is not properly protected. The vector shows a network path with a low privilege account and no user interaction, so the person needs valid access to a Remote Login session already.
The network vector suggests the flaw matters most on Macs with Remote Login switched on. The bulletin text is scoped to macOS Sonoma.
How to check if you're exposed
On a Mac, the Terminal can print the installed macOS version and list pending updates:
sw_vers
softwareupdate --list
About This Mac in the Apple menu shows the same version number.
To see whether Remote Login is on, look in System Settings, then General, then Sharing, and find the Remote Login toggle. From the Terminal, an administrator can run:
sudo systemsetup -getremotelogin
It prints whether Remote Login is on or off.
What to do now
- Update Sonoma Macs to 14.2 or later.
- Turn off Remote Login on Macs that do not need it.
- Where it is needed, restrict which users can log in over SSH and require key based login.
- Review who holds full disk access grants on your Macs and remove any that are not justified.
- Log SSH sign ins on shared Macs so unusual sessions are visible.
Why it matters
Full disk access is a macOS privacy permission that lets a process read protected user data such as mail and messages. Normally an SSH session does not get it. The state management bug meant a Remote Login session could end up with that permission without the usual grant.
The vector in the record is network based, needs a low privilege account and no user interaction, and the impact is high across the board. That makes it a post authentication problem: someone who can already sign in remotely could reach more than intended. The class, CWE-922, fits a protection that was not applied. The KEV flag is false.
Quick check
Does it matter if Remote Login is off?
The record shows a network vector, and Apple's text is about Remote Login sessions, so turning it off likely reduces exposure. You should still install the update.
Sources
- Apple: About the security content of macOS Sonoma 14.2
- Apple: macOS Sonoma 14.2 bulletin (legacy link)
Last reviewed: 19 October 2026.
