CVE-2025-24107
Published: 27 January 2025
Summary
CVE-2025-24107 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Apple Ipados. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Employs least privilege to restrict malicious apps from escalating to root access beyond necessary permissions.
Enforces access control policies to prevent permissions issues allowing unauthorized root privilege escalation by apps.
Implements a reference monitor to mediate all app access to system resources, directly countering the permissions bypass to root.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local permissions flaw (CWE-276) enabling privilege escalation from a malicious app to root access on macOS and other Apple platforms, directly matching Exploitation for Privilege Escalation.
NVD Description
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, watchOS 11.3. A malicious app may be able to gain root privileges.
Deeper analysisAI
CVE-2025-24107 is a permissions issue, classified under CWE-276, that was addressed through additional restrictions in Apple operating systems. The vulnerability affects iOS and iPadOS prior to version 18.3, macOS Sequoia prior to 15.3, tvOS prior to 18.3, and watchOS prior to 11.3. It has a CVSS v3.1 base score of 7.8 (High), reflecting a local attack vector with low complexity, requiring low privileges, no user interaction, and high impacts on confidentiality, integrity, and availability.
A local attacker, such as one who has installed a malicious app on the device, can exploit this vulnerability to escalate privileges and gain root access. With root privileges, the attacker achieves full control over the system, potentially allowing unauthorized data access, modification of critical files, or disruption of services.
Apple security advisories confirm the issue is fixed in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, and watchOS 11.3 by implementing additional permissions restrictions, as detailed in support documents such as https://support.apple.com/en-us/122066 and related updates. Users and administrators should apply these patches promptly to mitigate the risk.
Details
- CWE(s)