CVE-2025-24107
Published: 27 January 2025
Summary
CVE-2025-24107 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Apple Ipados. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-24107 is a permissions issue, classified under CWE-276, that was addressed through additional restrictions in Apple operating systems. The vulnerability affects iOS and iPadOS prior to version 18.3, macOS Sequoia prior to 15.3, tvOS prior to 18.3, and watchOS prior to 11.3. It has a CVSS v3.1 base score of 7.8 (High), reflecting a local attack vector with low complexity, requiring low privileges, no user interaction, and high impacts on confidentiality, integrity, and availability.
A local attacker, such as one who has installed a malicious app on the device, can exploit this vulnerability to escalate privileges and gain root access. With root privileges, the attacker achieves full control over the system, potentially allowing unauthorized data access, modification of critical files, or disruption of services.
Apple security advisories confirm the issue is fixed in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, and watchOS 11.3 by implementing additional permissions restrictions, as detailed in support documents such as https://support.apple.com/en-us/122066 and related updates. Users and administrators should apply these patches promptly to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3621
Vulnerability details
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, watchOS 11.3. A malicious app may be able to gain root privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local permissions flaw (CWE-276) enabling privilege escalation from a malicious app to root access on macOS and other Apple platforms, directly matching Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Employs least privilege to restrict malicious apps from escalating to root access beyond necessary permissions.
Enforces access control policies to prevent permissions issues allowing unauthorized root privilege escalation by apps.
Implements a reference monitor to mediate all app access to system resources, directly countering the permissions bypass to root.