CVE-2025-31194
Published: 31 March 2025
Summary
CVE-2025-31194 is a critical-severity Missing Authorization (CWE-862) vulnerability in Apple Macos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces least privilege to prevent Shortcuts from executing with unnecessary administrative privileges without authentication, directly mitigating the privilege escalation vulnerability.
Requires enforcement of approved authorizations, addressing the improper state management that allowed unauthorized access to administrative functions in Shortcuts.
Defines and limits specific actions permissible without identification or authentication, preventing administrative Shortcut execution without proper checks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote unauthenticated exploitation over the network to execute Shortcuts with administrative privileges without authorization, directly facilitating T1190 (Exploit Public-Facing Application) for initial access and T1068 (Exploitation for Privilege Escalation) to achieve full system compromise.
NVD Description
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A Shortcut may run with admin privileges without authentication.
Deeper analysisAI
CVE-2025-31194 is an authentication vulnerability caused by improper state management, affecting the Shortcuts feature in macOS. This flaw allows a Shortcut to execute with administrative privileges without requiring authentication. The issue impacts macOS Sequoia versions prior to 15.4, macOS Sonoma prior to 14.7.5, and macOS Ventura prior to 13.7.5. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862 (Missing Authorization).
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables the attacker to run a Shortcut with admin privileges, achieving high impacts on confidentiality, integrity, and availability, which could result in full system compromise.
Apple advisories indicate the issue was fixed with improved state management in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Security practitioners should apply these updates promptly, with further details available in the referenced Apple support pages and Full Disclosure mailing list postings.
Details
- CWE(s)