Apple iOS and iPadOS Incorrect Authorization Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-02-12

[ Description ]Official description

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

CISA: Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 5 Mar 2025): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• support.apple.com/en-us/122173Release NotesVendor Advisory
• support.apple.com/en-us/122174Release NotesVendor Advisory
• support.apple.com/en-us/122345Release NotesVendor Advisory
• support.apple.com/en-us/122346Release NotesVendor Advisory
• seclists.org/fulldisclosure/2025/Apr/7Mailing ListThird Party Advisory
• seclists.org/fulldisclosure/2025/Feb/7Mailing ListThird Party Advisory
• seclists.org/fulldisclosure/2025/Feb/8Mailing ListThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource