中危
Apple多款产品任意文件读写漏洞
2025-04-16 18:24:31 公开 ，2026-04-02 19:29:47 更新
- CISA KEV
- 关键漏洞
- 公开PoC
- 远程
- CWEs：
- CWE-1220 （Insufficient Granularity of Access Control）
- SSVC：
- 可利用状态：已被积极利用攻击自动化：是技术影响评估：全部 2025-11-25 12:55:31
风险信息
- CVSS v3.1 向量
- AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS v3.1 风险值
- 6.8
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- Apple iOS、iPadOS、macOS Sequoia、tvOS、visionOS包含任意读写漏洞，允许攻击者绕过指针身份验证。
- 修复建议
- 立即升级至tvOS 18.4.1、visionOS 2.4.1、iOS 18.4.1、iPadOS 18.4.1、macOS Sequoia 15.4.1或更高版本，参考链接： https://support.apple.com/en-us/122400 https://support.apple.com/en-us/122401 https://support.apple.com/en-us/122402 https://support.apple.com/en-us/122282
参考链接
- https://support.apple.com/en-us/122282
CVE · Vendor Advisory · Release Notes
- https://support.apple.com/en-us/122400
CVE · Vendor Advisory · Release Notes
- https://support.apple.com/en-us/122401
CVE · Vendor Advisory · Release Notes
- https://support.apple.com/en-us/122402
CVE · Vendor Advisory · Release Notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201
NVD · US Government Resource
- http://seclists.org/fulldisclosure/2025/Oct/3
NVD · Mailing List · Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Jun/14
NVD · Mailing List · Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Apr/26
NVD · Mailing List · Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Oct/4
NVD · Mailing List · Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Oct/0
NVD · Mailing List · Third Party Advisory
- https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md
NVD · Exploit
- https://github.com/cisagov/vulnrichment/issues/200
NVD · Issue Tracking