CVE-2025-24200
Apple iOS and iPadOS Incorrect Authorization Vulne - [Actively Exploited]
Description
An authorization issue was addressed with improved state management. This issue is fixed in iPadOS 17.7.5, iOS 18.3.1 and iPadOS 18.3.1. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
INFO
Published Date :
Feb. 10, 2025, 7:15 p.m.
Last Modified :
Feb. 18, 2025, 6:15 p.m.
Source :
[email protected]
Remotely Exploitable :
No
Impact Score :
5.2
Exploitability Score :
0.9
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
https://support.apple.com/en-us/122173 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24200
Public PoC/Exploit Available at Github
CVE-2025-24200 has a 2 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-24200.
| URL | Resource |
|---|---|
| https://support.apple.com/en-us/122173 | Release Notes Vendor Advisory |
| https://support.apple.com/en-us/122174 | Release Notes Vendor Advisory |
| http://seclists.org/fulldisclosure/2025/Feb/7 | Mailing List Third Party Advisory |
| http://seclists.org/fulldisclosure/2025/Feb/8 | Mailing List Third Party Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild and CryptoGen Nepal aims to simplify this for the general public in a more understandable way as well as in a format that can be easily integrated into their threat intelligence systems.
cve json rss cgn cisa kev
Python HTML
CVE-2025-24200 - Incorrect Authorization
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-24200 vulnerability anywhere in the article.
-
BleepingComputer
Serbian police used Cellebrite zero-day hack to unlock Android phones
Serbian authorities have reportedly used an Android zero-day exploit chain developed by Cellebrite to unlock the device of a student activist in the country and attempt to install spyware. Cellebrite ... Read more
-
The Cyber Express
Microsoft Patch Tuesday for February Includes Two Zero Days Under Attack
Microsoft’s Patch Tuesday for February 2025 fixes four zero-day vulnerabilities, including two under active attack, plus another eight flaws judged to be at high risk of attack. In all, the Patch Tues ... Read more
-
The Hacker News
Microsoft Uncovers Sandworm Subgroup's Global Cyber Attacks Spanning 15+ Countries
A subgroup within the infamous Russian state-sponsored hacking group known as Sandworm has been attributed to a multi-year initial access operation dubbed BadPilot that stretched across the globe. "Th ... Read more
-
The Hacker News
Researchers Find New Exploit Bypassing Patched NVIDIA Container Toolkit Vulnerability
Container Security / Vulnerability Cybersecurity researchers have discovered a bypass for a now-patched security vulnerability in the NVIDIA Container Toolkit that could be exploited to break out of a ... Read more
-
The Hacker News
Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation
Patch Tuesday / Vulnerability Microsoft on Tuesday released fixes for 63 security flaws impacting its software products, including two vulnerabilities that it said has come under active exploitation i ... Read more
-
krebsonsecurity.com
Microsoft Patch Tuesday, February 2025 Edition
Microsoft today issued security updates to fix at least 56 vulnerabilities in its Windows operating systems and supported software, including two zero-day flaws that are being actively exploited. All ... Read more
-
TheCyberThrone
CVE-2024-12797 OpenSSL Vulnerability Patched
CVE-2024-12797 is a critical security vulnerability discovered in OpenSSL, a widely used cryptographic library that provides secure communication over computer networks. This vulnerability poses signi ... Read more
-
TheCyberThrone
CISA Adds Microsoft and Zyxel Vulnerabilities to KEV Catalog
On February 11, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities, associate ... Read more
-
Dark Reading
Apple Releases Urgent Patch for USB Vulnerability
Source: Simon Dack via Alamy Stock PhotoNEWS BRIEFApple has released a security update for a vulnerability that the tech giant reports may have been exploited in an "extremely sophisticated attack."No ... Read more
-
Help Net Security
Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391)
February 2025 Patch Tuesday is here, and Microsoft has delivered fixes for 56 vulnerabilities, including two zero-days – CVE-2025-21418 and CVE-2025-21391 – under active exploitation. CVE-2025-21418 a ... Read more
-
TheCyberThrone
Apple devices on verge of exploitation of CVE-2025-24200
CVE-2025-24200 is a critical security vulnerability discovered in Apple’s iOS and iPadOS. This vulnerability has severe implications for device security, especially considering the widespread use of t ... Read more
-
Ars Technica
iOS 18.3.1 update fixes security flaw used in “extremely sophisticated attack”
Apple has released new security fixes for iPhones and iPads in the form of iOS 18.3.1 and iPadOS 18.3.1. According to Apple's release notes, these updates patch an actively exploited security flaw in ... Read more
-
The Cyber Express
Apple Patches Actively Exploited iOS Zero-Day CVE-2025-24200 in Emergency Update
Apple has issued emergency updates to fix a critical security flaw that is actively being exploited in iOS and iPadOS. On February 10, the tech giant released out-of-band security patches to address a ... Read more
-
Help Net Security
Apple fixes zero-day flaw exploited in “extremely sophisticated” attack (CVE-2025-24200)
Users of iPhones and iPads that run iOS/iPadOS 18 and iPadOS 17 are urged to implement the latest updates to plug a security feature bypass vulnerability (CVE-2025-24200) exploited in the wild in “an ... Read more
-
The Hacker News
Apple Patches Actively Exploited iOS Zero-Day CVE-2025-24200 in Emergency Update
Zero-Day / Mobile Security Apple on Monday released out-of-band security updates to address a security flaw in iOS and iPadOS that it said has been exploited in the wild. Assigned the CVE identifier C ... Read more
-
seclists.org
APPLE-SA-02-10-2025-2 iPadOS 17.7.5
Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 10 Feb 2025 11:32:41 -0800 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more
-
seclists.org
APPLE-SA-02-10-2025-1 iOS 18.3.1 and iPadOS 18.3.1
Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Mon, 10 Feb 2025 11:28:53 -0800 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more
-
security.nl
Apple waarschuwt voor iOS-lek gebruikt bij 'zeer geraffineerde aanval'
Apple waarschuwt voor een kwetsbaarheid in iOS en iPadOS die volgens het techbedrijf bij een 'zeer geraffineerde aanval' tegen bepaalde specifieke personen is gebruikt. Het beveiligingslek (CVE-2025-2 ... Read more
-
BleepingComputer
Apple fixes zero-day exploited in 'extremely sophisticated' attacks
Apple has released emergency security updates to patch a zero-day vulnerability that the company says was exploited in targeted and "extremely sophisticated" attacks. "A physical attack may disable US ... Read more
The following table lists the changes that have been made to the
CVE-2025-24200 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Mar. 07, 2025
Action Type Old Value New Value -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Feb. 18, 2025
Action Type Old Value New Value Removed CVSS V3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Removed CWE CWE-863 -
Initial Analysis by [email protected]
Feb. 13, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Added CWE NIST CWE-863 Added CPE Configuration OR *cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* versions up to (excluding) 17.7.5 *cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* versions from (including) 18.0 up to (excluding) 18.3.1 *cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions up to (excluding) 18.3.1 Changed Reference Type http://seclists.org/fulldisclosure/2025/Feb/7 No Types Assigned http://seclists.org/fulldisclosure/2025/Feb/7 Mailing List, Third Party Advisory Changed Reference Type http://seclists.org/fulldisclosure/2025/Feb/8 No Types Assigned http://seclists.org/fulldisclosure/2025/Feb/8 Mailing List, Third Party Advisory Changed Reference Type https://support.apple.com/en-us/122173 No Types Assigned https://support.apple.com/en-us/122173 Release Notes, Vendor Advisory Changed Reference Type https://support.apple.com/en-us/122174 No Types Assigned https://support.apple.com/en-us/122174 Release Notes, Vendor Advisory -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Feb. 13, 2025
Action Type Old Value New Value Added Date Added 2025-02-12 Added Due Date 2025-03-05 Added Vulnerability Name Apple iOS and iPadOS Incorrect Authorization Vulnerability Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Feb. 11, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Removed CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Feb. 11, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Added CWE CWE-863 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Feb. 11, 2025
Action Type Old Value New Value Added Reference http://seclists.org/fulldisclosure/2025/Feb/7 Added Reference http://seclists.org/fulldisclosure/2025/Feb/8 -
New CVE Received by [email protected]
Feb. 10, 2025
Action Type Old Value New Value Added Description An authorization issue was addressed with improved state management. This issue is fixed in iPadOS 17.7.5, iOS 18.3.1 and iPadOS 18.3.1. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Added Reference https://support.apple.com/en-us/122173 Added Reference https://support.apple.com/en-us/122174
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-24200 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-24200
weaknesses.