CVE-2025-24200
medium · 6.1Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Added 2025-02-12Remediation due 2025-03-05
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
6.1
CVSS
4.5%
EPSS (exploit prob.)
91st
EPSS percentile
2025-02-10
Published
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-863
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apple | ipados | < 15.8.4 |
| apple | ipados | >= 16.0, < 16.7.11 |
| apple | ipados | >= 17.0, <= 17.7.5 |
| apple | ipados | >= 18.0, < 18.3.1 |
| apple | iphone_os | < 15.8.4 |
| apple | iphone_os | >= 16.0, < 16.7.11 |
| apple | iphone_os | >= 17.0, < 18.3.1 |
Check a specific version with /api/v1/cve/match.
References
- https://support.apple.com/en-us/122173
- https://support.apple.com/en-us/122174
- https://support.apple.com/en-us/122345
- https://support.apple.com/en-us/122346
- http://seclists.org/fulldisclosure/2025/Apr/7
- http://seclists.org/fulldisclosure/2025/Feb/7
- http://seclists.org/fulldisclosure/2025/Feb/8
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24200
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2025-24200