CVE-2025-24200
Apple iOS and iPadOS Incorrect Authorization Vulnerability
Description
CVE-2025-24200 is a medium-severity authorization vulnerability in Apple iOS and iPadOS that allows a physical attacker to disable USB Restricted Mode on a locked device. Rated with a CVSS v3.1 base score of 6.1, this vulnerability was addressed in iPadOS 17.7.5, iOS 18.3.1, and iPadOS 18.3.1 through improved state management. Apple has acknowledged that this issue may have been exploited in an extremely sophisticated attack targeting specific individuals. CISA has added CVE-2025-24200 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 5, 2025. The EPSS score of 40.71% at the 97.3rd percentile indicates very high exploitation probability, placing it among the most actively targeted mobile device vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.8.4; >= 16.0, < 16.7.11; >= 17.0, <= 17.7.5; >= 18.0, < 18.3.1 |
| apple | iphone os | < 15.8.4; >= 16.0, < 16.7.11; >= 17.0, < 18.3.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://support.apple.com/en-us/122173(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122174(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122345(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122346(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/7(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Feb/7(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Feb/8(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24200(US Government Resource)
Weakness Type
Authorization / State Management Weakness
CVE-2025-24200 is caused by an authorization issue stemming from improper state management in iOS and iPadOS. USB Restricted Mode is a security feature introduced to prevent unauthorized USB accessories from communicating with a locked device after a period of inactivity. The vulnerability arises from incorrect state tracking in the authorization logic, allowing a physical attacker to manipulate the device state in a way that disables USB Restricted Mode protections without proper user authorization. This undermines a critical defense mechanism designed to protect against forensic data extraction tools.
Learn more: CWE-285 — Improper Authorization
Impact Analysis
CVE-2025-24200 poses a significant threat to individuals and organizations relying on Apple device physical security features. The vulnerability requires physical access (AV:P) with low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). Confidentiality (High): Disabling USB Restricted Mode on a locked device allows forensic data extraction tools to establish USB communication with the device. This enables attackers to attempt data extraction, passcode brute-forcing, or exploitation of USB-based attack vectors that USB Restricted Mode was specifically designed to prevent. For targeted individuals such as journalists, activists, executives, and government officials, this represents a direct threat to personal and communications security. Integrity (High): Once USB Restricted Mode is bypassed, an attacker with physical access can potentially install profiles, modify device configurations, or inject data through USB-based tools that would otherwise be blocked on a locked device. Availability: No direct availability impact (A:N) is indicated, though the compromise of device integrity could lead to further exploitation affecting device functionality. Apple's acknowledgment that this was exploited in "extremely sophisticated attacks against specific targeted individuals" indicates this is a targeted exploitation tool likely used by state-level actors or advanced forensic service providers. The EPSS score of 40.71% at the 97.3rd percentile confirms very high exploitation probability, and the ransomware status is listed as Unknown.
Exploit Maturity
CVE-2025-24200 demonstrates confirmed exploit maturity with sophisticated real-world exploitation. Apple has explicitly acknowledged that this vulnerability "may have been exploited in an extremely sophisticated attack against specific targeted individuals," indicating use by advanced threat actors with physical access capabilities, likely in the context of law enforcement forensics or state-sponsored surveillance. CISA has confirmed active exploitation by adding CVE-2025-24200 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 5, 2025. Apple has released patched versions: iOS 18.3.1 and iPadOS 18.3.1 and iPadOS 17.7.5. The EPSS score of 40.71% at the 97.3rd percentile places this in the top 3% of all tracked vulnerabilities for exploitation likelihood. The ransomware use status is listed as Unknown by CISA, though the physical access requirement makes ransomware deployment through this specific vector unlikely.
Remediation
-
Update all Apple devices immediately. Install iOS 18.3.1, iPadOS 18.3.1, or iPadOS 17.7.5 depending on your device and iOS/iPadOS version. These updates are available through Settings > General > Software Update on the device or through Apple Configurator for managed devices. For older devices, update to iOS/iPadOS 15.8.4 which also addresses this vulnerability.
-
Enable automatic updates on all managed devices. Ensure that automatic software updates are enabled in device management profiles to receive security patches as soon as they become available. For enterprise MDM environments, push the update through your mobile device management solution.
-
Review physical security practices for high-risk individuals. If your organization manages devices for individuals who may be targets of sophisticated physical attacks (executives, government officials, journalists, activists), review and strengthen physical device security protocols. Ensure devices are not left unattended in vulnerable locations.
-
Audit device management logs for anomalies. For enterprise-managed devices, review MDM logs for any unusual USB accessory connections, profile installations, or configuration changes that could indicate a device was physically compromised before the patch was applied.
-
Educate users about physical security threats. Inform device users about the importance of maintaining physical control of their devices and the risks associated with leaving devices unattended, particularly in environments where targeted surveillance is a concern. Emphasize that USB Restricted Mode is a critical security feature that should remain enabled.
Technical Details
CVE-2025-24200 is an authorization vulnerability in Apple iOS and iPadOS caused by improper state management in the USB Restricted Mode implementation. The CVSS v3.1 vector string CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reveals: Attack Vector (Physical): The attacker must have physical access to the target device, making this a targeted rather than mass-exploitation vulnerability. Attack Complexity (Low): Once physical access is obtained, the exploitation technique is straightforward. Privileges Required (None): No prior device access, passcode, or biometric authentication is needed. User Interaction (None): The attack can be performed on a locked, unattended device. Confidentiality and Integrity (High): Disabling USB Restricted Mode exposes the device to USB-based data extraction and modification attacks. USB Restricted Mode was introduced by Apple as a defensive measure against forensic tools like Cellebrite and GrayKey that use USB connections to extract data from locked iOS devices. When enabled, USB Restricted Mode blocks USB data connections after the device has been locked for one hour, requiring the user to unlock the device before USB accessories can communicate. CVE-2025-24200 allows an attacker to manipulate the device's authorization state in a way that disables this protection, re-enabling USB data connections on a locked device. The fix addresses the vulnerability through improved state management, ensuring that the USB Restricted Mode state cannot be improperly modified without proper user authorization. The affected versions span iOS and iPadOS releases before 15.8.4, between 16.0 and 17.7.5, and between 18.0 and 18.3.1.
Frequently Asked Questions
Is CVE-2025-24200 being actively exploited?
Yes. Apple has confirmed that this vulnerability may have been exploited in "extremely sophisticated attacks against specific targeted individuals." CISA has also added it to the Known Exploited Vulnerabilities catalog with a March 5, 2025 remediation deadline.
What is USB Restricted Mode and why does this matter?
USB Restricted Mode is an Apple security feature that blocks USB data connections after a device has been locked for one hour. It was designed to prevent forensic tools from extracting data through USB connections. CVE-2025-24200 allows a physical attacker to disable this protection, re-enabling USB data access on a locked device.
Which Apple devices are affected by CVE-2025-24200?
All iPhones and iPads running iOS or iPadOS versions before 15.8.4, between 16.0 and 17.7.5, and between 18.0 and 18.3.1 are affected. Apple has released patches in iOS 18.3.1, iPadOS 18.3.1, iPadOS 17.7.5, and iOS/iPadOS 15.8.4.
Is CVE-2025-24200 a remote vulnerability?
No. CVE-2025-24200 requires physical access to the target device. It cannot be exploited remotely over a network. The attack vector is classified as Physical (AV:P), meaning the attacker must have hands-on access to the device to disable USB Restricted Mode.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.