Vulnerability

CERT-In Vulnerability Note CIVN-2025-0019
Security Bypass Vulnerability in Apple iOS and iPadOS

Original Issue Date:February 13, 2025

Severity Rating: HIGH

Software Affected

Apple iOS and iPadOS versions prior to 18.3.1 (Available for iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later)
Apple iPadOS versions prior to 17.7.5 (Available for iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation)

Overview

A Vulnerability has been reported in Apple iOS and iPadOS which could allow an attacker to disable USB Restricted Mode on a locked device leading to bypass security restrictions on the targeted system.

Target Audience:
Individual and organizational users of Apple iOS and iPadOS devices

Risk Assessment:
High risk of unauthorized access to data

Impact Assessment:
Potential for access to sensitive data

Description

USB Restricted Mode in Apple devices is designed to disable data access through the Lightning port. This feature prevents digital forensics tools from gaining unauthorized entry.

This vulnerability exists due to an authorization issue in the Accessibility component of Apple iOS and iPadOS. An attacker could exploit this vulnerability in an extremely sophisticated attack to disable USB Restricted Mode on a locked device.

Successful exploitation of this vulnerability could allow the attacker to bypass security restrictions on the target system to gain access to sensitive information.

Note: The vulnerability is being exploited in the wild. Users are advised to apply patches urgently.

Solution

Apply appropriate software updates as mentioned in the Apple Security updates:
https://support.apple.com/en-us/122173

https://support.apple.com/en-us/122174

Vendor Information

Apple
https://support.apple.com/en-us/122173
https://support.apple.com/en-us/122174

References

Apple
https://support.apple.com/en-us/122173
https://support.apple.com/en-us/122174

CVE Name
CVE-2025-24200

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India