Historical catalog analysis: CISA added this entry on February 12, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-24200 is an incorrect authorization vulnerability (CWE-863) affecting Apple iOS and iPadOS. The flaw allows an attacker with physical access to a locked device to disable USB Restricted Mode. This mode is intended to limit USB connectivity on locked devices to prevent unauthorized data extraction or interface interaction.
Exposure and applicability
This vulnerability applies to organizations managing fleets of Apple iOS and iPadOS devices where physical security cannot be guaranteed. The primary exposure path requires the attacker to have direct, physical access to the hardware. Because the bypass targets a security feature designed to protect locked devices, the risk is highest for high-value assets or personnel operating in environments where device seizure is a plausible threat.
Remediation priorities
Based on our analysis, vulnerability management teams should prioritize remediation based on the physical risk profile of the device users. We recommend the following actions:
- Identify Affected Assets: Inventory all iOS and iPadOS devices within the environment to determine which are running versions susceptible to this authorization bypass.
- Deploy Vendor Mitigations: Apply the updates or mitigations provided by Apple as specified in their official security guidance.
- Evaluate Device Lifecycle: For legacy hardware that may no longer receive vendor updates, evaluate whether those devices should be discontinued or replaced if they handle sensitive data and are prone to physical theft or seizure.
How to validate remediation
Verification must go beyond a simple version check, as a deployed update does not inherently prove the vulnerability is mitigated in the active runtime environment.
Defenders should verify that USB Restricted Mode remains active and cannot be bypassed via known physical triggers on updated devices. Validation evidence should consist of confirming the successful application of the vendor’s specific patch and testing the device’s behavior when connected to a USB peripheral while locked, ensuring the restricted mode persists as intended.
Limits and open questions
Applying a patch could reduce the likelihood of this specific bypass, but it does not eliminate all physical attack vectors against mobile hardware. Residual risk remains regarding other potential authorization flaws or hardware-level exploits that may exist outside the scope of CVE-2025-24200. It remains unknown whether this vulnerability has been leveraged in active ransomware campaigns.
Source and editorial note
CVE-2025-24200: Apple iOS and iPadOS Incorrect Authorization Vulnerability · Source date: February 12, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: February 15, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 25, 2026 at 00:17 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗