CVE-2025-43223
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Description
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. A non-privileged user may be able to modify restricted network settings.
Analysis
Improper input validation in Apple's network configuration subsystem across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows unauthenticated remote attackers to trigger denial-of-service conditions and enables non-privileged local users to modify restricted network settings. Fixed in iOS/iPadOS 18.6/17.7.9, macOS Sequoia 15.6, Sonoma 14.7.7, Ventura 13.7.7, tvOS 18.6, visionOS 2.6, and watchOS 11.6. EPSS score of 0.15% (36th percentile) indicates low predicted exploitation probability, and no public exploit identified at time of analysis.
Technical Context
This vulnerability stems from CWE-20 (Improper Input Validation) in Apple's network configuration framework, which handles network settings management and validation across the operating system stack. The flaw affects core OS components responsible for enforcing privilege boundaries on network configuration parameters. The CVSS vector AV:N indicates network-accessible attack surface, suggesting the input validation failure occurs in a network-facing service or API. The dual impact - both remote DoS and local privilege escalation for network settings modification - indicates the vulnerable code path processes both remote network requests and local API calls without proper input sanitization. This affects multiple Apple platforms sharing common networking infrastructure: iOS/iPadOS (mobile), macOS (desktop across three major versions), tvOS (streaming devices), visionOS (spatial computing), and watchOS (wearables).
Affected Products
This vulnerability impacts Apple iOS versions prior to 18.6, iPadOS versions prior to 18.6 and 17.7.9, macOS Sequoia versions prior to 15.6, macOS Sonoma versions prior to 14.7.7, macOS Ventura versions prior to 13.7.7, tvOS versions prior to 18.6, visionOS versions prior to 2.6, and watchOS versions prior to 11.6. The broad CPE coverage (cpe:2.3:o:apple:iphone_os, cpe:2.3:o:apple:ipados, cpe:2.3:o:apple:macos, cpe:2.3:o:apple:tvos, cpe:2.3:o:apple:visionos, cpe:2.3:o:apple:watchos) indicates this is a cross-platform issue affecting Apple's entire operating system portfolio. Official vendor advisories are available at Apple Support documents 124147 through 124155, with additional disclosure details in SecLists Full Disclosure archives (July 2025, posts 30-37).
Remediation
Update to vendor-released patched versions immediately: iOS 18.6, iPadOS 18.6 or 17.7.9 (depending on device compatibility), macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, or watchOS 11.6. Apple has addressed this through improved input validation in the network configuration subsystem. Organizations should prioritize updates for internet-facing devices and multi-user systems. For devices that cannot be immediately updated, consider network segmentation to limit exposure to untrusted networks and restrict local user access to shared devices. Detailed patching instructions and security content descriptions are available in Apple's security advisories at https://support.apple.com/en-us/124147 through https://support.apple.com/en-us/124155. No workarounds are documented as alternatives to patching.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today