iOS CVE-2025-24200: USB Restricted Mode Bypass

What to do

1. Check the OS version on every managed iPhone and iPad in your MDM inventory, or under Settings > General > About.
2. Update anything below 18.3.1 (or the 17.7.5 / 16.7.11 / 15.8.4 backports for older hardware).
3. Enforce a minimum OS version in MDM and block corporate data on devices below it.
4. Retire devices that cannot run a fixed release.
5. Turn on Lockdown Mode for high-risk users so a locked device will not connect to accessories or computers.

How to check if you are affected or compromised

• There are no public indicators of compromise; Apple disclosed no exploit details beyond the advisory.
• List devices that were out of their owner's control (border search, arrest, theft, repair) while running a version below the fix.
• Treat data on such devices as possibly extracted: rotate passwords, tokens and app sessions that were stored on them.

What happened#

On February 10, 2025, Apple released iOS and iPadOS 18.3.1 and iPadOS 17.7.5 to fix CVE-2025-24200, an authorization flaw in the Accessibility component. Apple's description: "A physical attack may disable USB Restricted Mode on a locked device." Apple said it was aware of a report that the issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals." Bill Marczak of the Citizen Lab at the University of Toronto found it. CISA added it to the KEV catalog on February 12. Apple backported the fix to iOS 16.7.11 and iOS 15.8.4 on March 31, 2025. NVD scores it CVSS 3.1 6.1 with a physical attack vector.

USB Restricted Mode is the defense against forensic extraction boxes. Once a device has been locked for more than an hour, it cuts data connections over the port until the owner unlocks it. Bypass it, and a seized phone can be attached to such tools again. Quarkslab's patch diff found that the fix added lock-state checks in an Accessibility (Assistive Touch) alert path and in profiled. Before the fix, an accessibility prompt shown on the lock screen could switch the restriction off. Quarkslab described its real-world attack theory, via an accessibility switch accessory, as untested.

Who is affected#

These versions are affected:

• iOS and iPadOS 18 before 18.3.1 (iPhone XS and later, and current iPads)
• iPadOS 17 before 17.7.5 (iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, iPad 6th generation)
• iOS 16 before 16.7.11 (iPhone 8, 8 Plus and X, plus some older iPads)
• iOS 15 before 15.8.4 (iPhone 6s, iPhone 7, iPhone SE 1st generation, iPad Air 2, iPad mini 4, iPod touch 7th generation)

Apple has not said who carried out the attacks or which tool used the bug. That was still the case as of Oct 23, 2026.

Do you really need to act?#

Most people and most fleets do not. The attacker must physically hold your locked device. Nothing here is remotely exploitable. Devices with automatic updates turned on picked up the fix long ago, and it is now 20 months old.

It still matters for two groups. The first is managed fleets with stragglers: devices pinned to an old version by MDM, or old hardware that never took a backport. The second is people whose threat model includes device seizure, such as journalists, activists, lawyers, and executives crossing borders. For them this is exactly the kind of bug that defeats a locked phone, and the next one will look similar.

What to do now#

1. Pull OS versions from your MDM inventory, or check Settings > General > About on unmanaged devices.
2. Update anything below 18.3.1, or below 17.7.5, 16.7.11 or 15.8.4 on hardware limited to those lines. Better still, move to the current release.
3. Set a minimum OS version in MDM and block corporate mail and data on devices below it.
4. Retire devices that cannot run a fixed release.
5. For high-risk users, enable Lockdown Mode, under which "the device needs to be unlocked" before it connects to an accessory or another computer.

How to tell if you were hit#

Expect little on-device evidence, because this is a physical-access bug that unlocks data transfer. Apple published no indicators of compromise, and there is no log entry to search for. The practical test is procedural. Was the device out of its owner's control while it ran a vulnerable version, for example during a border search, an arrest, a theft or a repair? If so, assume its data may have been copied. Rotate the passwords, tokens and app sessions it held, and review account access logs for new sign-ins.

Timeline#

• Feb 10, 2025 — Apple ships iOS/iPadOS 18.3.1 and iPadOS 17.7.5 and notes possible exploitation.
• Feb 12, 2025 — CISA adds CVE-2025-24200 to KEV.
• Feb 14, 2025 — Quarkslab publishes its patch analysis.
• Mar 5, 2025 — CISA's remediation deadline for federal agencies.
• Mar 31, 2025 — Apple backports the fix to iOS 16.7.11 and 15.8.4.

Vulnerability records

• CVE-2025-24200 · KEV 2025-02-12 · An authorization issue was addressed with improved state management.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apple — About the security content of iOS 18.3.1 and iPadOS 18.3.1 support.apple.com
2. Apple — About the security content of iPadOS 17.7.5 support.apple.com
3. Apple — About the security content of iOS 16.7.11 and iPadOS 16.7.11 support.apple.com
4. Apple — About the security content of iOS 15.8.4 and iPadOS 15.8.4 support.apple.com
5. CVE record — CVE-2025-24200 cve.org
6. NVD — CVE-2025-24200 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2025-24200 cisa.gov
8. Quarkslab — First analysis of Apple's USB Restricted Mode bypass (CVE-2025-24200) blog.quarkslab.com
9. Apple — About Lockdown Mode support.apple.com