CVE-2025-24200

What it actually does

CVE-2025-24200 is an authorization bypass in Apple iOS and iPadOS state management that can allow a physically present attacker to disable USB Restricted Mode on a locked device. USB Restricted Mode is intended to limit data access over Lightning/USB-C after a device has been locked for a period of time. If bypassed, an attacker with the device in hand may be able to interact with the device through USB interfaces that should remain restricted, enabling downstream forensic extraction, pairing, or exploitation workflows against locked devices. Apple reports the issue may have been exploited in highly sophisticated attacks against specific targeted individuals.

Why it matters to the business

The primary risk is compromise of sensitive data from lost, stolen, seized, or temporarily accessed iPhones and iPads, especially for executives, journalists, activists, government personnel, legal staff, and other high-risk users. Because this vulnerability is in CISA KEV with active in-the-wild exploitation and a remediation due date of 2025-03-05, organizations should treat unpatched devices as high-priority exposure even though exploitation requires physical access. Operational consequences can include exposure of confidential communications, credentials, documents, personal data, and regulatory or legal risk if managed devices are compromised while locked.

How an attack unfolds

An attacker first obtains temporary or sustained physical access to a locked iPhone or iPad running a vulnerable iOS or iPadOS version. The attacker uses a specialized USB-connected tool or exploit workflow to trigger the authorization state-management flaw and disable or bypass USB Restricted Mode. Once the USB interface is no longer properly restricted, the attacker can attempt to establish or abuse a device connection, interact with lockdown/pairing services, and proceed with additional tooling to extract data, stage further exploits, or perform forensic acquisition. The attack is not typically remote or opportunistic; it is most relevant to targeted physical-access scenarios and has reportedly been used in extremely sophisticated attacks against selected individuals.

How to fix it

Update affected Apple devices to fixed versions or later: iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, and iPadOS 17.7.5. Where possible, enforce minimum OS versions using MDM and block access to corporate resources from devices below the fixed releases. For high-risk users, enable strong passcodes, reduce device unlock exposure, require rapid patch compliance, minimize unattended physical access, and consider travel/incident handling procedures for devices that leave custody. If a device was lost, seized, or briefly out of user control while unpatched, treat it as potentially compromised and perform mobile forensic triage before returning it to trusted use.

How to confirm the fix worked

Confirm each iPhone and iPad reports an OS version at or above the fixed release applicable to its major version. Use MDM inventory, Apple Business/School Manager-integrated management platforms, or local device settings to validate iOS/iPadOS build compliance. Test policy enforcement by ensuring devices below the required versions are flagged, quarantined, or blocked from managed resources. For high-risk fleets, verify that USB accessory restrictions remain enabled, managed configuration profiles are intact, and no unexpected pairing relationships or trust prompts are present. Because exploitation is physical and may leave limited artifacts, lack of logs should not be treated as proof of non-exploitation.

Typical attack path

1. Identify a target using a vulnerable iPhone or iPad version.
2. Gain physical access to the locked device through theft, seizure, interdiction, or brief hands-on access.
3. Connect the device to a specialized USB accessory, forensic workstation, or exploit appliance.
4. Trigger the authorization/state-management weakness to disable or bypass USB Restricted Mode while the device remains locked.
5. Attempt USB-based pairing, lockdown service interaction, forensic extraction, or additional device exploitation.
6. Exfiltrate accessible data or use the USB access path to support follow-on compromise.

How to detect it

Detection should focus on evidence of physical access, unexpected USB trust or pairing activity, and suspicious device state changes around the time the device was out of custody. Useful sources include MDM inventory and compliance records, mobile threat defense telemetry, Apple device analytics if collected, host logs from computers that may have connected to devices, USB connection histories, endpoint logs showing Apple Mobile Device services, and forensic acquisition artifacts from the iPhone or iPad. Look for devices that were vulnerable at the time of a loss/seizure event, unexpected new pairing records, trust prompts the user does not recognize, connections to unknown workstations or forensic tools, and unusual lockdown/usbmuxd/accessory-related activity. On macOS or Windows systems used to connect mobile devices, review Apple Mobile Device, usbmuxd, lockdownd, Finder/iTunes, and device pairing artifacts. Because Apple described exploitation as extremely sophisticated and targeted, indicators may be sparse; absence of obvious artifacts does not rule out exploitation.

• USB Restricted Mode
• com.apple.mobile.lockdown
• lockdownd
• usbmuxd
• AppleMobileDeviceService.exe
• Apple Mobile Device Service
• /var/db/lockdown/
• /private/var/db/lockdown/
• /Library/Lockdown/
• ~/Library/Lockdown/
• /var/run/usbmuxd
• /var/run/usbmuxd.pid
• com.apple.usbmuxd
• com.apple.accessoryd
• accessoryd
• MobileDevice.framework
• PairRecord
• HostID
• SystemBUID
• EscrowBag
• TrustStore

What your security team should do

• Immediately identify all managed iOS and iPadOS devices below iOS/iPadOS 15.8.4, 16.7.11, 17.7.5 for iPadOS 17, or 18.3.1 and prioritize updates.
• Use MDM compliance policies to enforce minimum fixed versions and restrict corporate access from noncompliant devices.
• Prioritize executives, privileged users, legal teams, security staff, journalists, public figures, government users, and users traveling to higher-risk regions.
• Investigate any report of device loss, seizure, unexplained physical access, or unexpected USB connection involving an unpatched device.
• Review MDM, EDR/mobile threat defense, and device inventory telemetry for anomalous USB pairing or trust events where available.
• For suspected cases, preserve the device state and engage qualified mobile forensic responders before wiping or reconnecting the device to trusted systems.
• Communicate that this is a physical-access targeted threat, not a general remote mass-exploitation issue, while still requiring urgent patching because it is known exploited.