Cyber Resilience

CVE-2025-24117

Apple Ipados ≤ 17.7.4

Published
27 January 2025
Modified
02 April 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score 0.0027 19th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-24117 is a medium-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Apple Ipados. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, watchOS 11.3. An app may be able to fingerprint the user.

CWE(s)
CWE-922

Related Threats

CVEs Like This One

CVE-2024-54541Same product: Apple Ipados
CVE-2024-23217Same product: Apple Ipados
CVE-2023-42823Same product: Apple Ipados
CVE-2023-27942Same product: Apple Ipados
CVE-2024-23290Same product: Apple Ipados
CVE-2024-40813Same product: Apple Ipados
CVE-2024-27789Same product: Apple Ipados
CVE-2025-43374Same product: Apple Ipados
CVE-2026-28943Same product: Apple Ipados
CVE-2026-28877Same product: Apple Ipados

Affected Assets

apple
ipados
≤ 17.7.4 · 18.0 — 18.3
apple
iphone os
≤ 18.3
apple
macos
≤ 15.3
apple
visionos
≤ 2.3
apple
watchos
≤ 11.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-4 Information Flow Enforcement
  • SC-28 Protection of Information at Rest
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces access decisions so that apps receive only properly redacted data, directly blocking the fingerprinting vector described in the CVE.

AC-4 Information Flow Enforcement good match
prevent

Controls information flows between system components and apps, ensuring sensitive fields are filtered or redacted before disclosure.

SC-28 Protection of Information at Rest partial match
prevent

Requires cryptographic or logical protection of sensitive information at rest so that inadequate redaction cannot expose usable data to an app.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforces least-privilege permissions and authorization reviews that limit read/write access to stored sensitive data.

PR.DS-01 mostly match
prevents

Directly protects data-at-rest confidentiality via encryption or access controls that prevent unauthorized reads.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.10 Storage media none match
none

Secure reuse and disposal procedures, including cryptographic wiping and physical destruction, stop the insecure storage of sensitive data on media that may later be accessed by unauthorized actors.

A.7.14 Secure disposal or re-use of equipment none match
none

Mandating secure disposal techniques stops the insecure retention of sensitive information on storage media that leaves organizational control.

References