CVE-2025-24200: Apple iOS and iPadOS Incorrect Authorization Vulnerability
Apple · iOS and iPadOS
Vendor fix available · Affected: Apple iOS and iPadOS · Exploitation: in CISA KEV since 12 Feb 2025
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue12 Feb 2025
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not established: not seen
Higher than 91% of scored CVEs
Federal deadline
CISA KEV · added 12 Feb · catalogue entry
Passed 619 days ago
DescriptionNVD
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
- CISA KEV
- Listed since 12 Feb 2025 · catalogue entry
- Public check
- No public nuclei template
- Vendor
- Apple
- Published
- February 2025
What changed
- CISA added it to the KEV catalogue CISA
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Coverage1 article · 1 outlet
First in our coverage: Infosecurity, 30 Sep.
- Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone AttacksInfosecurity · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.