CVE-2025-24206

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-04-29

Last updated on: 2026-04-02

Assigner: Apple Inc.

Description

An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may be able to bypass authentication policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-04-29

Last Modified

2026-04-02

Generated

2026-07-23

AI Q&A

2025-04-30

EPSS Evaluated

2026-07-22

NVD

CVE-2025-24206

EUVD

EUVD-2025-12736

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 17.7.6 (exc)
apple	ipados	From 18.0 (inc) to 18.4 (exc)
apple	iphone_os	to 18.4 (exc)
apple	macos	to 13.7.5 (exc)
apple	macos	From 14.0 (inc) to 14.7.5 (exc)
apple	macos	From 15.0 (inc) to 15.4 (exc)
apple	tvos	to 18.4 (exc)
apple	visionos	to 2.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass flaw caused by faulty state management. Essentially, the issue allowed an attacker on the local network to bypass the authentication policy, enabling unauthorized access. It has been addressed and fixed in multiple Apple operating systems including macOS, tvOS, iOS, iPadOS, and visionOS. [1]

Impact Analysis

If you are using any of the affected Apple operating systems, an attacker on your local network could exploit this vulnerability to bypass authentication controls. This could potentially lead to unauthorized access or compromise of your system's security. [1]

Mitigation Strategies

Based on the provided information, you should upgrade your systems to one of the fixed versions released by Apple. For example, update to macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4, iPadOS 18.4, or visionOS 2.4. [1]

Hi! I’m here to help you understand CVE-2025-24206. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70