What is the CVSS score of CVE-2025-43223?

CVE-2025-43223 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of iOS are affected by CVE-2025-43223?

CVE-2025-43223 affects Apple's network configuration subsystem across all major platforms (iOS, macOS, tvOS, visionOS, watchOS), allowing unauthenticated remote attackers to cause denial-of-service…

How to fix or mitigate CVE-2025-43223?

Within 24 hours: Inventory all Apple devices across iOS, macOS, tvOS, visionOS, and watchOS in your environment and identify current OS versions. Within 7 days: Deploy patches-iOS/iPadOS 18.6 or 17.7.9, macOS Sequoia 15.6, Sonoma 14.7.7, or Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6-to all endpoints prioritizing corporate-managed devices. Within 30 days: Complete patch deployment across all remaining devices and validate network configuration controls are functioning post-update.

iOS CVE-2025-43223

HIGH

Improper Input Validation (CWE-20)

2025-07-30 product-security@apple.com

Apple iOS macOS Denial Of Service Privilege Escalation Ipados Iphone Os Tvos Visionos Watchos

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

HIGH 7.5

DescriptionCVE.org

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. A non-privileged user may be able to modify restricted network settings.

AnalysisAI

Improper input validation in Apple's network configuration subsystem across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows unauthenticated remote attackers to trigger denial-of-service conditions and enables non-privileged local users to modify restricted network settings. Fixed in iOS/iPadOS 18.6/17.7.9, macOS Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6. EPSS score of 0.15% (36th percentile) indicates low predicted exploitation probability, and no public exploit identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-20 (Improper Input Validation) in Apple's network configuration framework, which handles network settings management and validation across the operating system stack. The flaw affects core OS components responsible for enforcing privilege boundaries on network configuration parameters. The CVSS vector AV:N indicates network-accessible attack surface, suggesting the input validation failure occurs in a network-facing service or API. The dual impact - both remote DoS and local privilege escalation for network settings modification - indicates the vulnerable code path processes both remote network requests and local API calls without proper input sanitization. This affects multiple Apple platforms sharing common networking infrastructure: iOS/iPadOS (mobile), macOS (desktop across three major versions), tvOS (streaming devices), visionOS (spatial computing), and watchOS (wearables).

RemediationAI

Update to vendor-released patched versions immediately: iOS 18.6, iPadOS 18.6 or 17.7.9 (depending on device compatibility), macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, or watchOS 11.6. Apple has addressed this through improved input validation in the network configuration subsystem. Organizations should prioritize updates for internet-facing devices and multi-user systems. For devices that cannot be immediately updated, consider network segmentation to limit exposure to untrusted networks and restrict local user access to shared devices. Detailed patching instructions and security content descriptions are available in Apple's security advisories at https://support.apple.com/en-us/124147 through https://support.apple.com/en-us/124155. No workarounds are documented as alternatives to patching.