Home Tools CVE CVE-2025-24200
MEDIUM

CVE-2025-24200

Apple Ipados 2025-02-10 CVSS v3.1
CVSS
6.1
KEV

Description

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Summary dbcve.org

This is an authorization bypass vulnerability in iOS/iPadOS where a physical attack can disable USB Restricted Mode on a locked device. USB Restricted Mode is designed to block USB accessories from connecting to a locked device after a certain period, but this flaw allows an attacker with physical access to bypass this protection. Apple notes this was exploited in highly targeted attacks.

Mitigation

Apply the available iOS/iPadOS security updates (15.8.4, 16.7.11, 18.3.1, or 17.7.5 depending on device) to address the authorization bypass. Organizations should inventory affected devices and prioritize patching for high-risk individuals.

Weakness (CWE)

CWE-863 Incorrect Authorization

EPSS Score

4.46%
Probability of exploitation in next 30 days
91th percentile

References

https://support.apple.com/en-us/122173 Release Notes, Vendor Advisory https://support.apple.com/en-us/122174 Release Notes, Vendor Advisory https://support.apple.com/en-us/122345 Release Notes, Vendor Advisory https://support.apple.com/en-us/122346 Release Notes, Vendor Advisory http://seclists.org/fulldisclosure/2025/Apr/7 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2025/Feb/7 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2025/Feb/8 Mailing List, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24200 US Government Resource
View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE