CVE-2025-30432 Overview
CVE-2025-30432 is a logic flaw in Apple's operating systems that weakens the passcode lockout protection on locked devices. A malicious application can attempt passcode entries against a locked device and only triggers escalating time delays after four failed attempts, rather than being blocked earlier. Apple addressed the issue with improved state management across its product line. The flaw is categorized under [CWE-287] (Improper Authentication) and affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
Critical Impact
A malicious app installed on a device can attempt passcode entries against the lock screen, undermining the standard brute-force protections designed to safeguard the device passcode.
Affected Products
- Apple iOS and iPadOS (fixed in iOS 18.4, iPadOS 18.4, and iPadOS 17.7.6)
- Apple macOS Sonoma 14.7.5 and macOS Ventura 13.7.5
- Apple tvOS 18.4, visionOS 2.4, and watchOS 11.4
Discovery Timeline
- 2025-03-31 - CVE-2025-30432 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30432
Vulnerability Analysis
The vulnerability is a logic issue in how Apple's operating systems track passcode entry attempts originating from applications on a locked device. Apple's passcode subsystem is designed to introduce escalating time delays after each failed attempt to defeat brute-force attacks. In the flawed implementation, an app can submit multiple passcode entry attempts before the throttling mechanism engages, with escalating delays only applied after four failed attempts.
This weakens the core protection model of the device lock screen. Apple resolved the flaw by improving state management for passcode attempt tracking, ensuring that lockout timers apply consistently across attempt sources.
Root Cause
The root cause is improper state tracking in the authentication subsystem. The system did not correctly account for attempts originating from a malicious app when computing when to apply escalating delays. As a result, a caller could enqueue several entries before the throttling state advanced, giving an attacker additional attempts within a shorter window than the design intended.
Attack Vector
Exploitation requires a malicious application to be installed and running on the target device, with the device in a locked state. The attacker uses the app to programmatically submit passcode entries against the lock screen. Because escalating delays only trigger after four failures, the attacker gains a small but meaningful advantage over the intended rate-limiting model. The attack does not require user interaction beyond initial app installation.
No public proof-of-concept exploit or exploitation in the wild has been reported. CISA has not added the issue to the Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-30432
Indicators of Compromise
- Unexpected repeated Face ID, Touch ID, or passcode prompts on a locked device without user interaction.
- Presence of unsigned or sideloaded applications that request keychain or authentication-related entitlements without a clear purpose.
- Anomalous background activity from third-party apps immediately before the device lock screen displays failed-attempt warnings.
Detection Strategies
- Review mobile device management (MDM) telemetry for devices running Apple OS versions below the patched builds listed in the Apple security advisories.
- Correlate application install events with lock screen state changes to identify apps active while the device was locked.
- Audit device compliance policies to flag Apple endpoints that have not yet applied the March 2025 security updates.
Monitoring Recommendations
- Enforce OS version compliance checks through MDM and alert on devices below the fixed builds.
- Ingest Apple device inventory and patch status into a centralized data lake to surface unpatched populations at scale.
- Monitor Apple's security release channel for follow-on advisories related to authentication state management.
How to Mitigate CVE-2025-30432
Immediate Actions Required
- Upgrade all Apple devices to the patched OS versions: iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, and watchOS 11.4.
- Enforce update deployment through MDM using enforced install deadlines to reduce dwell time on vulnerable builds.
- Restrict installation of untrusted or sideloaded applications on managed devices.
Patch Information
Apple released fixes in the OS versions listed above. Full details are available in the vendor advisories: Apple Support #122371, #122372, #122374, #122375, #122377, and #122378.
Workarounds
- Configure a strong alphanumeric passcode of significant length rather than a short numeric PIN, materially increasing brute-force cost.
- Restrict application installation to the official App Store and require app vetting through MDM.
- Enable the Erase Data after 10 failed passcode attempts setting to cap the impact of any bypass attempt.
# Example MDM compliance check: enforce minimum Apple OS versions
# iOS/iPadOS >= 18.4 (or iPadOS 17.7.6 on legacy hardware)
# macOS Sonoma >= 14.7.5, macOS Ventura >= 13.7.5
# watchOS >= 11.4, tvOS >= 18.4, visionOS >= 2.4
# Enable erase-after-failed-attempts on managed iOS devices via configuration profile
# Payload key: maxFailedAttempts = 10
# Payload key: requireAlphanumeric = true
# Payload key: minLength = 8
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
