CVE-2025-24200 — Apple iOS and iPadOS Incorrect Authorization Vulnerability

provenance: imported · CVE: CVE-2025-24200

CVE-2025-24200: Apple iOS and iPadOS Incorrect Authorization Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Apple
Product	iOS and iPadOS
Date added	2025-02-12
Due date	2025-03-05
Ransomware campaign use	Unknown

Description

Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.

Required action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://support.apple.com/en-us/122173 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24200

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24200
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog