Incorrect Authorization Vulnerability (CVE‑2025‑24200) Allows Physical Attacker to Disable USB Restricted Mode on iOS/iPadOS
What It Is – Apple iOS 15‑17 and iPadOS 15‑17 contain an authorization flaw that lets an attacker with physical access bypass the USB Restricted Mode on a locked device, exposing the device to data‑exfiltration via a USB connection.
Exploitability – The vulnerability is exploitable with physical possession of the device; no remote code execution is required. Apple has issued a security update (iOS 17.5.1 / iPadOS 17.5.1) that mitigates the issue.
Affected Products – iPhone 12‑15 series, iPad Pro/Air/mini (2022‑2024) running iOS 15‑17 / iPadOS 15‑17.
Why It Matters for Trust & Control Assurance
- Access‑control assurance – The flaw undermines the “authorized access only” control objective, a core element of many frameworks (e.g., NIST CSF PR.AC‑1).
- Audit‑ready evidence – Demonstrating that devices enforce USB Restricted Mode is a tangible control‑evidence point auditors will request.
- Continuous monitoring – Detecting devices that have not applied the patch or that have USB Restricted Mode disabled requires ongoing configuration monitoring.
Recommended Actions
- Deploy Apple’s iOS 17.5.1 / iPadOS 17.5.1 update immediately across all managed devices.
- Enforce USB Restricted Mode via your MDM solution and verify compliance through regular configuration scans.
- Incorporate physical‑security controls (e.g., device‑locker policies) to limit attacker proximity.
- Log any attempts to connect unauthorized USB peripherals and correlate with endpoint detection alerts.
Source: CISA KEV – CVE‑2025‑24200