Security features bypass in Apple iOS and iPadOS - CVE-2025-24200
Published: February 10, 2025
Vulnerability identifier: #VU103756
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-24200
CWE-ID: CWE-254
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows an attacker to bypass implemented security restrictions.
The vulnerability exists due to an authorization error. An attacker with physical access to device can disable USB Restricted Mode on a locked device and compromise the affected system.
Note, the vulnerability is being exploited in the wild in an extremely sophisticated attack against specific targeted individuals.
Affected software
Apple iOS
iPadOS
iPadOS
How to mitigate CVE-2025-24200
Install updates from vendor's website.
Apple iOS - addressed in versions 18.3.1 22D72, 15.8.4 19H390, 16.7.11 20H360
iPadOS - addressed in versions 18.3.1 22D72, 15.8.4 19H390, 16.7.11, 17.7.5
iPadOS - addressed in versions 18.3.1 22D72, 15.8.4 19H390, 16.7.11, 17.7.5