CVE-2025-24200: Apple iOS and iPadOS Incorrect Authorization Vulnerability

Published Feb 10, 2025
·
Updated

Accessibility. An authorization issue was addressed with improved state management.

Other sources

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

— MITRE

Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.

— CISA

Credit

Bill Marczak(The Citizen Lab at The University of Toronto), Apple

Affected Software

15 affected componentsFixes available
Apple iOS and iPadOS
Apple iPadOS<17.7.5
17.7.5
Apple iOS<18.3.1
18.3.1
Apple iPadOS<18.3.1
18.3.1
Apple iOS<15.8.4
15.8.4
Apple iPadOS<15.8.4
15.8.4
Apple iOS<16.7.11
16.7.11
Apple iPadOS<16.7.11
16.7.11
Apple iPadOS<15.8.4
Apple iPadOS>=16.0<16.7.11
Apple iPadOS>=17.0<=17.7.5
Apple iPadOS>=18.0<18.3.1
Apple iPhone OS<15.8.4
Apple iPhone OS>=16.0<16.7.11
Apple iPhone OS>=17.0<18.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.7.5
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 18.3.1
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.8.4
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 16.7.11
  5. Upgrade

    Upgrade Apple iOS to a version that resolves this vulnerability.

    Fixed in 15.8.4
  6. Upgrade

    Upgrade Apple iPadOS to a version that resolves this vulnerability.

    Fixed in 15.8.4
  7. Upgrade

    Upgrade Apple iOS to a version that resolves this vulnerability.

    Fixed in 16.7.11
  8. Upgrade

    Upgrade Apple iPadOS to a version that resolves this vulnerability.

    Fixed in 16.7.11
  9. Upgrade

    Upgrade Apple iOS to a version that resolves this vulnerability.

    Fixed in 18.3.1
  10. Upgrade

    Upgrade Apple iPadOS to a version that resolves this vulnerability.

    Fixed in 18.3.1
  11. Upgrade

    Upgrade Apple iPadOS to a version that resolves this vulnerability.

    Fixed in 17.7.5
  12. Compensating control

    Discontinue use of the product if mitigations are unavailable.

Event History

Feb 10, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Affected Software
CVE Published
via MITRE·07:04 PM
Data Sourced
via MITRE·07:04 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Feb 11, 2025
News Published
via Dark Reading·09:41 PM
News Published
via Dark Reading·09:49 PM
Feb 12, 2025
Known Exploited
via CISA·12:00 AM
Feb 28, 2025
News Published
via BleepingComputer·04:27 PM
News Published
via BleepingComputer·04:28 PM
Mar 31, 2025
Updated
via Apple·12:00 AM
Affected Software
Apr 1, 2025
News Published
via BleepingComputer·01:35 PM
Apr 2, 2025
News Published
via The Register·06:13 AM
News Published
via The Register·06:16 AM
Apr 16, 2025
News Published
via BleepingComputer·06:06 PM
Jul 30, 2025
News Published
via BleepingComputer·04:10 PM
Sep 16, 2025
News Published
via BleepingComputer·12:16 PM
Dec 12, 2025
News Published
via BleepingComputer·11:23 PM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-24200?

The severity of CVE-2025-24200 is classified as high due to the potential for unauthorized access.

2

How do I fix CVE-2025-24200?

To fix CVE-2025-24200, upgrade to iPadOS version 17.7.5 or iOS/iPadOS version 18.3.1.

3

What type of vulnerability is CVE-2025-24200?

CVE-2025-24200 is an authorization issue related to state management.

4

Are my devices affected by CVE-2025-24200?

Devices running iPadOS versions before 17.7.5 and iOS/iPadOS versions before 18.3.1 are affected by CVE-2025-24200.

5

What impact does CVE-2025-24200 have on device security?

CVE-2025-24200 may allow physical attacks to disable USB Restricted Mode, potentially compromising device security.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203