CVE-2025-31184: Apple visionOS Auth Bypass Vulnerability

CVE-2025-31184 Overview

CVE-2025-31184 is a permissions-checking flaw affecting multiple Apple operating systems and the Safari browser. The issue allows an application to gain unauthorized access to the Local Network, bypassing the privacy controls Apple uses to gate such access. Apple addressed the vulnerability with improved permissions checking in Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, and visionOS 2.4. The weakness is classified under [CWE-281] (Improper Preservation of Permissions).

Critical Impact
A malicious or compromised app can reach Local Network resources without user consent, enabling reconnaissance and lateral movement against printers, routers, IoT devices, and internal services on the same network.

Affected Products

Apple Safari (prior to 18.4)
Apple iOS and iPadOS (prior to 18.4)
Apple macOS Sequoia (prior to 15.4) and Apple visionOS (prior to 2.4)

Discovery Timeline

2025-03-31 - CVE-2025-31184 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2025-31184

Vulnerability Analysis

Apple platforms enforce a Local Network privacy gate that requires user approval before an app may discover or communicate with devices on the same LAN. CVE-2025-31184 stems from incomplete permissions checking in this enforcement path. An app subject to the Local Network privacy control can interact with hosts on the local subnet without the expected entitlement or user consent prompt.

The flaw spans Safari and the operating system stacks across iOS, iPadOS, macOS, and visionOS, indicating the defect lives in shared networking or permission-mediation code rather than a single product. Apple's fix description states the issue was addressed with improved permissions checking.

Root Cause

The root cause is an authorization gap [CWE-281] in the Local Network access mediation logic. The pre-patch code path failed to consistently verify that the calling app held the required Local Network entitlement before forwarding traffic to or accepting responses from LAN-scoped destinations.

Attack Vector

Exploitation requires local execution context and user interaction, consistent with a malicious or trojanized app being installed and launched. Once running, the app can enumerate hosts, query mDNS/Bonjour services, and reach internal HTTP, SMB, or device-management endpoints that would normally be blocked behind the Local Network prompt. Verified exploitation code or public proof-of-concept references are not listed in the advisory data.

No verified proof-of-concept code is available for CVE-2025-31184.
Refer to Apple Support Articles 122371, 122373, 122378, and 122379
for vendor technical details.

Detection Methods for CVE-2025-31184

Indicators of Compromise

Applications generating unexpected mDNS, SSDP, or unicast traffic to RFC1918 ranges without a corresponding Local Network permission prompt in system logs.
Outbound connections from sandboxed App Store apps to LAN management interfaces such as router admin pages, printers, or NAS devices.
Endpoint telemetry showing apps issuing ARP scans or rapid sequential connections across the local subnet.

Detection Strategies

Inventory installed apps on iOS, iPadOS, macOS, and visionOS endpoints and correlate against OS build versions below the patched releases.
Hunt in network telemetry for non-browser, non-system processes initiating Local Network discovery on hosts running pre-18.4 / pre-15.4 / pre-2.4 builds.
Review MDM compliance reports for devices that have not received the Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, or visionOS 2.4 updates.

Monitoring Recommendations

Enable per-app network logging through MDM and forward results to a centralized SIEM or data lake for anomaly review.
Monitor for unauthorized scans of internal management VLANs originating from end-user Apple devices.
Track update adoption rates for the patched OS and Safari versions across the fleet.

How to Mitigate CVE-2025-31184

Immediate Actions Required

Update affected devices to Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, or visionOS 2.4 or later.
Push the updates through MDM with an enforced deadline and verify build numbers post-deployment.
Audit installed third-party apps and remove any that are untrusted, sideloaded, or no longer maintained.

Patch Information

Apple released fixes in Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, and visionOS 2.4. Vendor details are available in Apple Support Article 122371, Apple Support Article 122373, Apple Support Article 122378, and Apple Support Article 122379.

Workarounds

Segment user Wi-Fi from sensitive management, IoT, and server VLANs so that unauthorized Local Network access yields minimal reachable assets.
Restrict app installation sources via MDM configuration profiles and disable unnecessary sideloading on managed devices.
Revoke Local Network permissions for apps that do not require LAN access under Settings > Privacy & Security > Local Network.

bash

# Example: enforce minimum OS version via MDM policy (pseudocode)
require ios_version >= 18.4
require ipados_version >= 18.4
require macos_version >= 15.4
require visionos_version >= 2.4
require safari_version >= 18.4