CVE-2025-30460
Published: 31 March 2025
Summary
CVE-2025-30460 is a high-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique TCC Manipulation (T1548.006); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations to prevent apps from bypassing permissions and accessing protected user data.
Requires identification, reporting, and correction of flaws like this permissions vulnerability via patching to fixed macOS versions.
Employs least privilege to limit app access to only necessary resources, mitigating excessive permissions on protected user data.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a macOS permissions bypass (CWE-284) allowing unauthorized access to protected user data due to inadequate enforcement; this directly facilitates abuse of the TCC access control framework (T1548.006) and enables collection of sensitive data from the local system (T1005).
NVD Description
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.
Deeper analysisAI
CVE-2025-30460 is a permissions issue, classified under CWE-284 (Improper Access Control), affecting macOS versions prior to Sequoia 15.4, Sonoma 14.7.5, and Ventura 13.7.5. The vulnerability enables an app to access protected user data due to inadequate permission enforcement.
The CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates that unauthenticated attackers can exploit it over a network with no user interaction or privileges required, though it demands high attack complexity. Successful exploitation allows the app to compromise high confidentiality and integrity of protected user data.
Apple's security advisories detail the fix, which removes vulnerable code and adds additional checks. Systems should be updated to macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5 for mitigation, as outlined in support documents at https://support.apple.com/en-us/122373, https://support.apple.com/en-us/122374, and https://support.apple.com/en-us/122375, with further discussion in Full Disclosure archives.
Details
- CWE(s)