CVE-2025-43454CWE-284broken-access-control

CVE-2025-43454

High · published November 4, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

⚡ A device that just won’t lock? That’s the issue here! This high-severity vulnerability in iOS and iPadOS can leave your device wide open to unauthorized access. 🚪🔓 Think of your phone like a hotel room that forgets to lock the door after you leave. Anyone can walk in and snoop around if the security isn’t tight! Without a proper lock, someone could gain access to your device, potentially exposing your personal information, apps, and sensitive data. This could lead to unauthorized actions where your device becomes a playground for mischief!

Put simply

Think of your phone like a hotel room that forgets to lock the door after you leave. Anyone can walk in and snoop around if the security isn’t tight! This vulnerability stems from poor state management, leading to a failure in the device's ability to lock properly after being idle. Essentially, it allows the device to remain unlocked longer than intended.

What to do

Without a proper lock, someone could gain access to your device, potentially exposing your personal information, apps, and sensitive data. This could lead to unauthorized actions where your device becomes a playground for mischief! Update your devices to iOS 18.7.2, iPadOS 18.7.2, or iOS 26.1, iPadOS 26.1 immediately. Make sure to check your settings to ensure that auto-lock is functioning correctly after the update. You’ve got this! With these updates, your device will be secure and ready to go. 🛡️💪

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00463 · 39.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-11-04T07:15Z
Affected products (2)
ProductVersionsFixed in
apple/ipados< 26.126.1
apple/iphone_os< 26.126.1
References (2)
EPSS history
Timeline
  • 04 NOV 01:16Z
    This issue was addressed through improved state management
    cvelistv5