CVE-2025-43217
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Description
The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed.
Analysis
Privacy indicator bypass in Apple iOS and iPadOS allows local attackers to determine microphone or camera access without user notification. The vulnerability affects iOS 18.6 and earlier, and iPadOS 17.7.9 and earlier, enabling unauthorized monitoring of privacy-sensitive device activity. Apple has released patched versions (iOS 18.6, iPadOS 18.6, and iPadOS 17.7.9) that add logic to correctly display privacy indicators when microphone or camera access occurs. EPSS exploitation probability is very low at 0.02%, and no public exploit code has been identified.
Technical Context
This vulnerability exploits a flaw in the privacy indicator subsystem of Apple's operating systems, specifically in the mechanism responsible for notifying users when applications access the microphone or camera hardware. The root cause is classified under CWE-359 (Exposure of Private Information to an Unauthorized Actor), indicating that sensitive information about hardware access state is not properly communicated to the user through the standard visual privacy indicators. The affected products span multiple iOS and iPadOS versions across iPhone and iPad devices (cpe:2.3:o:apple:iphone_os and cpe:2.3:o:apple:ipados), suggesting the vulnerability exists in a core operating system component that manages privacy notifications across all affected device types.
Affected Products
Apple iPhone OS (iOS) versions prior to 18.6 are affected, along with Apple iPadOS versions prior to 18.6 and iPadOS 17.x versions prior to 17.7.9. The vulnerability impacts all iPhone and iPad devices running these operating system versions, as indicated by the CPE strings cpe:2.3:o:apple:iphone_os and cpe:2.3:o:apple:ipados. Full details on specific version ranges and device compatibility are available in Apple's official security advisories at https://support.apple.com/en-us/124147 and https://support.apple.com/en-us/124148.
Remediation
Users should immediately update to patched versions: iOS 18.6 or later for iPhone, iPadOS 18.6 or later for iPad, or iPadOS 17.7.9 or later for devices unable to upgrade to the current major version. The patch adds additional logic to the privacy indicator system to ensure microphone and camera access is correctly displayed to users. Updates are available through Settings > General > Software Update on affected devices. Users unable to update immediately should monitor their device for unexpected microphone or camera indicator activity and consider restricting app permissions through Settings > Privacy until updates can be applied. Consult Apple's security advisories at https://support.apple.com/en-us/124147 and https://support.apple.com/en-us/124148 for additional guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today