CVE-2025-24095

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-24095
This issue was addressed with additional entitlement checks. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4. An app may be able to bypass Privacy preferences.

7.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://support.apple.com/en-us/122371 Vendor Advisory
https://support.apple.com/en-us/122378 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
History

07 Apr 2025, 14:30

Type Values Removed Values Added
References () https://support.apple.com/en-us/122371 - () https://support.apple.com/en-us/122371 - Vendor Advisory
References () https://support.apple.com/en-us/122378 - () https://support.apple.com/en-us/122378 - Vendor Advisory
CPE cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
First Time Apple visionos
Apple iphone Os
Apple
Apple ipados

03 Apr 2025, 21:15

Type Values Removed Values Added
CWE CWE-288
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.6
Summary
  • (es) Este problema se solucionó con comprobaciones de derechos adicionales. Este problema está corregido en visionOS 2.4, iOS 18.4 y iPadOS 18.4. Es posible que una aplicación pueda omitir las preferencias de privacidad.

31 Mar 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-31 23:15

Updated : 2025-04-07 14:30

NVD link : CVE-2025-24095

Mitre link : CVE-2025-24095

CVE.ORG link : CVE-2025-24095

JSON object : View

Products Affected

apple

  • ipados
  • iphone_os
  • visionos
CWE
CWE-288

Authentication Bypass Using an Alternate Path or Channel