CVE-2025-24200

Опубликовано: 10 фев. 2025

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Ссылки

https://support.apple.com/en-us/122173
Release Notes
Vendor Advisory
https://support.apple.com/en-us/122174
Release Notes
Vendor Advisory
https://support.apple.com/en-us/122345
Release Notes
Vendor Advisory
https://support.apple.com/en-us/122346
Release Notes
Vendor Advisory
http://seclists.org/fulldisclosure/2025/Apr/7
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Feb/7
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Feb/8
Mailing List
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24200
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия до 15.8.4 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 16.0 (включая) до 16.7.11 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 17.0 (включая) до 17.7.5 (включая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 18.0 (включая) до 18.3.1 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 15.8.4 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия от 16.0 (включая) до 16.7.11 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия от 17.0 (включая) до 18.3.1 (исключая)

EPSS

Процентиль: 91%

0.04457

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-863

Связанные уязвимости

GHSA-hvw5-4g4q-2h8p

CVSS3: 7.5

github

больше 1 года назад

An authorization issue was addressed with improved state management. This issue is fixed in iPadOS 17.7.5, iOS 18.3.1 and iPadOS 18.3.1. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

BDU:2025-01367

CVSS3: 7.1

fstec

больше 1 года назад

Уязвимость функции USB Restricted Mode операционных систем iOS, iPadOS, позволяющая нарушителю получить несанкционированный доступ к устройству

EPSS

Процентиль: 91%

0.04457

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-863