CVE-2025-43454: Apple iPadOS Auth Bypass Vulnerability

CVE-2025-43454 Overview

CVE-2025-43454 is a state management vulnerability affecting Apple iOS and iPadOS. The flaw causes a device to persistently fail to lock, leaving the user interface accessible when it should be secured. Apple addressed the issue through improved state management in iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, and iPadOS 26.1. The weakness is classified under [CWE-284] Improper Access Control. No public exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Devices may remain unlocked when they should auto-lock, exposing user data and applications to anyone with physical or proximate access.

Affected Products

Apple iOS versions prior to 18.7.2 and prior to 26.1
Apple iPadOS versions prior to 18.7.2 and prior to 26.1
iPhone and iPad devices running affected OS builds

Discovery Timeline

2025-11-04 - CVE-2025-43454 published to the National Vulnerability Database
2025-12-17 - Last updated in NVD database

Technical Details for CVE-2025-43454

Vulnerability Analysis

The vulnerability resides in the device lock state machine within iOS and iPadOS. Under specific conditions, the operating system fails to transition the device into a locked state. The lock screen, which enforces user authentication before granting access to applications and data, does not engage as expected. This leaves the device in an authenticated state beyond the intended idle or user-initiated lock window. Apple categorized the fix as a state management improvement, indicating that the issue stems from how the system tracks and updates lock-related state transitions. The vulnerability impacts confidentiality because an attacker with physical access to the unlocked device can read messages, photos, email, and other sensitive content without supplying credentials or biometrics.

Root Cause

The root cause is improper management of internal state variables that govern the lock transition. When certain conditions occur, the state machine does not reach the locked state, and the lock screen is never displayed. This falls under [CWE-284] Improper Access Control because the access control mechanism — the lock screen — fails to activate.

Attack Vector

The attack vector listed in the NVD record is Network, with no privileges or user interaction required. In practice, exploitation requires the attacker to access the unlocked device, since the impact is the absence of the lock screen rather than remote code execution. Confidentiality is rated High, while integrity and availability are not affected. Apple has not published exploitation details in the referenced advisories.

No verified proof-of-concept code is available. Refer to the Apple Security Advisory #125632 and Apple Security Advisory #125633 for vendor technical details.

Detection Methods for CVE-2025-43454

Indicators of Compromise

Devices that remain on the home screen or in-app view after the configured auto-lock interval has elapsed.
User reports of iPhones or iPads that do not require Face ID, Touch ID, or passcode after expected idle timeouts.
Mobile device management (MDM) telemetry showing OS builds older than 18.7.2 or 26.1 on enrolled iPhones and iPads.

Detection Strategies

Query MDM inventory data to enumerate Apple devices reporting iOS or iPadOS versions prior to 18.7.2 and 26.1.
Cross-reference device compliance reports against the patched build numbers published in the Apple advisories.
Audit enterprise asset records for jailbroken or non-compliant Apple devices that bypass MDM update enforcement.

Monitoring Recommendations

Configure MDM compliance policies to flag and quarantine devices not running the patched iOS or iPadOS builds.
Track Apple security advisory releases and align update enforcement windows with vendor disclosure cadence.
Review physical device incident reports for cases involving lost or stolen iPhones and iPads that were assumed locked.

How to Mitigate CVE-2025-43454

Immediate Actions Required

Update all iPhones to iOS 18.7.2 or iOS 26.1 and all iPads to iPadOS 18.7.2 or iPadOS 26.1.
Enforce the update through MDM by pushing the corresponding minimum OS version policy.
Verify auto-lock settings under Settings > Display & Brightness > Auto-Lock on managed fleets.
Educate users to manually lock devices using the side or top button when leaving them unattended.

Patch Information

Apple released fixes in iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, and iPadOS 26.1. Patch details are documented in Apple Security Advisory #125632 and Apple Security Advisory #125633. Devices that cannot upgrade to the 26.x branch should install the 18.7.2 maintenance release.

Workarounds

Manually press the side button to lock devices instead of relying solely on auto-lock until patching is complete.
Shorten the auto-lock interval to the minimum value to reduce the window of exposure.
Restrict access to sensitive enterprise applications through MDM conditional access policies tied to OS version compliance.

bash

# Configuration example: verify installed iOS/iPadOS build via MDM query
# Example using an MDM DeviceInformation query payload
<dict>
  <key>RequestType</key>
  <string>DeviceInformation</string>
  <key>Queries</key>
  <array>
    <string>OSVersion</string>
    <string>BuildVersion</string>
    <string>ProductName</string>
  </array>
</dict>
# Flag devices where OSVersion < 18.7.2 or < 26.1