CVE-2025-24200KEV · OVERDUE

Apple iOS and iPadOS Incorrect Authorization Vulnerability

Medium · published February 10, 2025

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.1. It is confirmed in active exploitation. It sits in the 91.3th percentile for exploit probability.

598
days past CISA
deadline
CVSS v3.1
6.1
EPSS
4%
Percentile
91.3
In the wild
Confirmed
What it is

⚠️ A sneaky physical attack can disable USB Restricted Mode on your locked iPhone! If you've got a device running iOS or iPadOS, you’ll want to pay attention! Think of your device like a high-security hotel room. Even with a locked door, a clever thief might find a way to sneak in if the staff—your device—fails to check who’s coming and going appropriately. This vulnerability allows an attacker to bypass restrictions and potentially access sensitive data on your device. For targeted individuals, this could lead to a breach of personal information, putting their privacy at serious risk!

Put simply

Think of your device like a high-security hotel room. Even with a locked door, a clever thief might find a way to sneak in if the staff—your device—fails to check who’s coming and going appropriately. This authorization issue arises due to improper state management, enabling a physical attack to disable USB Restricted Mode on locked devices, which should otherwise protect against unauthorized access.

What to do

This vulnerability allows an attacker to bypass restrictions and potentially access sensitive data on your device. For targeted individuals, this could lead to a breach of personal information, putting their privacy at serious risk! Update your devices to the latest versions: iOS 15.8.4, 16.7.11, 18.3.1, or iPadOS 15.8.4, 16.7.11, 18.3.1, and 17.7.5 as soon as possible. Regularly review your security settings to ensure your devices are protected. 🛡️ You've got this! Stay vigilant and keep your devices updated! 🚀

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.04420 · 91.3th percentile
Published
2025-02-10T19:04Z
KEV added
2025-02-12 · due 2025-03-05
EPSS history
Timeline
  • 12 FEB 00:00Z
    Added to CISA KEV — remediate by Mar 5
    kev
  • 10 FEB 19:04Z
    An authorization issue was addressed with improved state management
    cvelistv5