CVE-2025-24200 is an incorrect authorization vulnerability in Apple iOS and iPadOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 12 February 2025, which means attackers have used it in real attacks. Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
What the vulnerability means in practice
Incorrect authorization in a mobile operating system is dangerous because the device may continue to trust a user or process after the lock state should have narrowed what is allowed. In this case, the issue matters because it can let a physical attacker disable USB Restricted Mode on a locked device, removing an important barrier against data access through the port.
That is not a generic software flaw, it is a trust failure in the authorization boundary. When a device is locked, the security model is supposed to reduce what local interaction can accomplish, especially around peripherals and data paths that can be abused during physical possession.
NHIMG’s Ultimate Guide to NHIs, Key Challenges and Risks is useful here because it explains the broader security pattern of over-trust and excessive privilege across access-boundary failures.
Why USB Restricted Mode is a meaningful control
USB Restricted Mode exists to limit accessory and data access when a device has been locked for long enough, which helps reduce the value of a stolen or unattended device. If an attacker can disable that protection, they may regain a path to interact with the device through USB in ways the owner did not intend.
The practical significance is that the control is not cosmetic. It is part of the layered defence that assumes physical possession can happen and tries to narrow what that possession buys the attacker. A failure here weakens the boundary between a locked state and a usable attack surface.
NIST Cybersecurity Framework 2.0 is a good lens for understanding how a single control weakness can affect protection, detection and recovery across the device lifecycle.
How organisations check exposure and prioritise response
Exposure is usually assessed by determining which Apple devices are in scope, whether they are still supported, and whether any are likely to face physical-access risk. For a KEV-listed issue, the key question is not just whether a patch exists, but whether the vulnerable device class is present, reachable by an attacker and important enough that a delay would be unacceptable.
Practitioners should also rely on vendor advisories and the CISA KEV catalogue for authoritative patch and version guidance rather than relying on secondary write-ups. For this term, the core operational issue is device inventory plus realistic exposure to physical access, not remote scanning alone.
CVE Program helps anchor the vulnerability identity, while NIST National Vulnerability Database is the standard place to cross-check the record and related metadata.
What should happen after patching or suspected exploitation
After remediation, organisations should treat any device that may have been physically handled as worthy of review, especially if the owner cannot account for its custody. A successful bypass of a locked-device control can justify closer inspection of local settings, logs where available, and any signs that the device’s trust posture changed during the window of exposure.
Because the issue concerns local authorization rather than server-side compromise, post-event review is about the device state and custody history as much as it is about software versioning. If the device was exposed to an attacker, the organisation should assume that access paths and sensitive data on or reachable from the device may need review.
Vulnerability Management Guide is the most relevant internal reference for tracking exploitation status, prioritisation and verification after remediation.
Risk and Threat Considerations
This vulnerability matters because a physically present attacker can use it to weaken a locked device’s protection boundary and potentially reach data or functions that should have remained constrained. The threat is especially important for mobile devices used in sensitive environments, where a short window of possession can be enough to change the device’s exposure profile.
Failure mechanism: The authorization decision around USB Restricted Mode can fail open under a physical attack path, allowing the device to enter a less restrictive state than intended while still appearing locked.
Impact: That loss of control can increase the chance of data access, tampering, or follow-on compromise of the device and any credentials, sessions or information stored on it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Locked-device authorization affects how access is enforced at the device boundary. |
| Recommendation — Review device access controls so locked-state protections cannot be bypassed unnoticed. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | The issue concerns whether an authenticated state remains properly enforced after lock. |
| AC-3 — Access Enforcement | USB Restricted Mode is an access enforcement mechanism that should not be disabled by unauthorized users. | |
| Recommendation — Verify that device authentication state still constrains access after the lock screen engages. Enforce device access rules so physical users cannot weaken restricted-mode protections. | ||
| CIS Controls v8 | CIS-5 — Account Management | Mobile-device access boundary failures are addressed through stronger control of who can alter access state. |
| Recommendation — Restrict who can change device security settings and review privileged access paths. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a control-integrity issue, not just a patching item. If an attacker can alter security settings on a locked device, the organisation’s assumptions about physical-device hardening are weaker than they appear.
What to watch for: Focus on devices with meaningful physical exposure, high-sensitivity data, or weak custody controls, because those are the cases where a bypass of a lock-state protection can have the most operational consequence.
Practitioner takeaway: Validate exposure, apply vendor guidance promptly, and review any device that may have been physically accessed while it was supposed to remain protected.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org