CVE-2025-24200

Description

An authorization issue was addressed with improved state management. This issue is fixed in iPadOS 17.7.5, iOS 18.3.1 and iPadOS 18.3.1. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

References

https://www.securityweek.com/apple-confirms-usb-restricted-mode-exploited-in-extremely-sophisticated-attack/

https://www.bleepingcomputer.com/news/apple/apple-fixes-zero-day-exploited-in-extremely-sophisticated-attacks/

https://thehackernews.com/2025/02/apple-patches-actively-exploited-ios.html

https://support.apple.com/en-us/122174

https://support.apple.com/en-us/122173

https://securityaffairs.com/174066/hacking/apple-fixes-iphone-and-ipad-bug-exploited-in-extremely-sophisticated-attacks.html

http://seclists.org/fulldisclosure/2025/Feb/8

http://seclists.org/fulldisclosure/2025/Feb/7

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3