Improper authentication in Apple iOS and iPadOS - CVE-2025-24193
Published: April 3, 2025
Vulnerability identifier: #VU106912
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-24193
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Apple Inc.
Affected software:
Apple iOS
iPadOS
Apple iOS
iPadOS
Detailed vulnerability description
The vulnerability allows an attacker to bypass authentication process.
The vulnerability exists due to an authentication error in MobileLockdown. An attacker with USB-C connection to an unlocked device can programmatically access photos.
How to mitigate CVE-2025-24193
Install updates from vendor's website.