{"id":"CVE-2025-24200","published":"2025-02-10T19:15:40Z","modified":"2026-06-17T08:58:17Z","title":"Apple iOS and iPadOS Incorrect Authorization Vulnerability","vendor":"Apple","product":"iOS and iPadOS","tier":"core","eol":null,"description":{"text":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an incorrect authorization issue in Apple's iOS and iPadOS, caused by state management that was not properly enforced. An attacker with physical access to a locked device can exploit it to disable USB Restricted Mode, the feature that blocks USB accessories from connecting while the device is locked, and no authentication or user interaction is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:22Z"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.04457,"percentile":0.91406,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-02-12","dueDate":"2025-03-05","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.apple.com/en-us/122173 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24200","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-02-10","exploitedFirstSeen":"2025-02-10","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2025-02-10"},{"url":"https://support.apple.com/en-us/122173","date":"2025-02-10"},{"url":"https://support.apple.com/en-us/122174","date":"2025-02-10"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-12"},{"url":"https://support.apple.com/en-us/122345","date":"2025-03-31"},{"url":"https://support.apple.com/en-us/122346","date":"2025-03-31"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://support.apple.com/en-us/122173","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122174","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122345","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122346","tags":["Release Notes","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/7","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Feb/7","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Feb/8","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24200","tags":["US Government Resource"]}],"techniques":[{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: physical attack bypasses defense mechanism on device","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A physical attack may disable USB Restricted Mode on a locked device","start":199,"end":267}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unlocked device enables local data access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"A physical attack may disable USB Restricted Mode on a locked device","start":199,"end":267}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-3671","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-3671","exploited":true,"exploitedSince":"2025-02-12","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1211"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2025-02-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24200","provenance":"source"},{"date":"2025-02-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2025-02-12","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-12","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-3671","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":2},"priority":{"score":60.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 627 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.28,"detail":"percentile 0.9141"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.27,"detail":"base score 6.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-863"}}