中危

Apple iOS和iPadOS安全漏洞(CVE-2025-24200)

2025-02-10 19:04:45 公开，2026-04-02 19:29:29 更新

CISA KEV
关键漏洞
勒索软件漏洞
APT漏洞
CWE Top 25 (2023)
CWE Top 25 (2024)
无需认证
公开PoC

CWEs：: CWE-863 （Incorrect Authorization）
SSVC：: 可利用状态：已被积极利用攻击自动化：否技术影响评估：部分 2025-02-13 12:55:19

风险信息

CVSS v3.1 向量: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3.1 风险值: 4.6

详细信息

漏洞类型: 其他
漏洞描述: Apple iOS和iPadOS状态管理存在不正确的授权漏洞，允许物理攻击者在锁定的设备上禁用USB限制模式。
修复建议: 此问题已在iPadOS 17.7.5、iOS 18.3.1和iPadOS 18.3.1中修复。参考链接： https://support.apple.com/en-us/122173 https://support.apple.com/en-us/122174

参考链接

http://seclists.org/fulldisclosure/2025/Feb/7
NVD · Third Party Advisory · Mailing List
http://seclists.org/fulldisclosure/2025/Feb/8
NVD · Third Party Advisory · Mailing List
https://nvd.nist.gov/vuln/detail/CVE-2025-24200
CNNVD
https://support.apple.com/en-us/122173
CVE · Release Notes · Vendor Advisory
https://support.apple.com/en-us/122174
CVE · Release Notes · Vendor Advisory
https://access.redhat.com/security/cve/cve-2025-24200
CNNVD
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24200
NVD · US Government Resource
http://seclists.org/fulldisclosure/2025/Apr/7
NVD · Mailing List · Third Party Advisory
https://support.apple.com/en-us/122346
CVE · Vendor Advisory · Release Notes
https://support.apple.com/en-us/122345
CVE · Vendor Advisory · Release Notes