CVE-2025-30436

This issue was addressed by restricting options offered on a locked device

Critical · published May 12, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

🔥 Siri could become your unwelcome eavesdropper! This vulnerability lets an attacker use Siri on a locked device to enable Auto-Answer Calls, giving them a sneaky entry point to your private conversations. 🚨 Think of it like a hotel room with a lock that only works sometimes — a clever thief who knows the trick can slip in and listen to your conversations without anyone being the wiser. If exploited, an attacker could listen in on your calls without your permission, turning your seemingly secure device into a privacy nightmare. This would lead to unauthorized access to sensitive information, and the potential for identity theft or harassment. Absolutely devastating!

Put simply

Think of it like a hotel room with a lock that only works sometimes — a clever thief who knows the trick can slip in and listen to your conversations without anyone being the wiser. This vulnerability arises from insufficient restrictions on options offered when a device is locked, allowing Siri to enable Auto-Answer Calls without proper authorization.

What to do

If exploited, an attacker could listen in on your calls without your permission, turning your seemingly secure device into a privacy nightmare. This would lead to unauthorized access to sensitive information, and the potential for identity theft or harassment. Absolutely devastating! Update your devices to iOS 18.4 or iPadOS 18.4 immediately to patch this critical flaw. Ensure that you regularly check for updates and enable security features that protect your device while locked. You've got this! Stay vigilant and keep those devices secure! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Published
2025-05-12T21:42Z
EPSS history
Timeline
  • 12 MAY 21:42Z
    This issue was addressed by restricting options offered on a locked device
    cvelistv5