erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: February 10, 2025

2 editorial briefs.

All digests · RSS · Markdown

Take stock

  • Check exposure: Apple CVE-2025-43200: iCloud Link Zero-Click, Graphite. Owners of Apple devices still below iOS 18.3.1, iPadOS 17.7.5, iOS 16.7.11, iOS 15.8.4, macOS 15.3.1, 14.7.4 or 13.7.4, watchOS 11.3.1 or visionOS 2.3.1, and security teams supporting journalists, activists or executives who got an Apple threat notification.
  • Most can relax: iOS CVE-2025-24200: USB Restricted Mode Bypass. MDM admins with devices below the fixed iOS/iPadOS releases, and journalists, activists, lawyers or executives whose phones could be seized, searched or stolen.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2025-43200

Apple CVE-2025-43200: iCloud Link Zero-Click, Graphite

Apple fixed this mercenary-spyware bug in February 2025, so any device on a current release is covered; the job is to find stragglers below the fixed builds and to take spyware warnings seriously if you protect journalists or other high-risk people.

Must act: Owners of Apple devices still below iOS 18.3.1, iPadOS 17.7.5, iOS 16.7.11, iOS 15.8.4, macOS 15.3.1, 14.7.4 or 13.7.4, watchOS 11.3.1 or visionOS 2.3.1, and security teams supporting journalists, activists or executives who got an Apple threat notification.

Can relax: Anyone whose Apple devices have taken an update since February 2025; the attack was narrowly targeted, and nothing suggests broad use.

  1. Pull an OS version report from your MDM and list every iPhone, iPad, Mac, Watch and Vision Pro below the fixed builds.
  2. Update or retire those devices; devices that cannot reach a fixed build should not hold work accounts.
  3. Enforce a minimum OS version in MDM or conditional access so unpatched devices cannot sync mail or chat.

Read the brief →

Most can relax

· Vulnerability · CVE-2025-24200

iOS CVE-2025-24200: USB Restricted Mode Bypass

Any iPhone or iPad updated since early 2025 is fixed; the attack needed the device in hand and hit a few targeted people, so only stragglers and high-risk users need a check.

Must act: MDM admins with devices below the fixed iOS/iPadOS releases, and journalists, activists, lawyers or executives whose phones could be seized, searched or stolen.

Can relax: Anyone on iOS or iPadOS 18.3.1 or later (or 17.7.5, 16.7.11 or 15.8.4 on older hardware), which covers every device that has accepted Apple's updates since spring 2025.

  1. Check the OS version on every managed iPhone and iPad in your MDM inventory, or under Settings > General > About.
  2. Update anything below 18.3.1 (or the 17.7.5 / 16.7.11 / 15.8.4 backports for older hardware).
  3. Enforce a minimum OS version in MDM and block corporate data on devices below it.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.