CVE-2025-43217

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43217", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-16T15:24:37.089Z", "datePublished": "2025-07-29T23:36:00.631Z", "dateUpdated": "2026-04-02T18:24:45.177Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Privacy Indicators for microphone or camera access may not be correctly displayed"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.6", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "17.7.9", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed."}], "references": [{"url": "https://support.apple.com/en-us/124147"}, {"url": "https://support.apple.com/en-us/124148"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:24:45.177Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-359", "lang": "en", "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-30T14:46:04.375783Z", "id": "CVE-2025-43217", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-30T14:46:14.101Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Jul/31"}, {"url": "http://seclists.org/fulldisclosure/2025/Jul/30"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:00:56.548Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-43217", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-30T14:46:04.375783Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-359", "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-30T14:45:53.980Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.6", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/124148"}, {"url": "https://support.apple.com/en-us/124147"}], "descriptions": [{"lang": "en", "value": "The issue was addressed by adding additional logic. This issue is fixed in iPadOS 17.7.9, iOS 18.6 and iPadOS 18.6. Privacy Indicators for microphone or camera access may not be correctly displayed."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Privacy Indicators for microphone or camera access may not be correctly displayed"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-07-29T23:54:52.992Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43217", "state": "PUBLISHED", "dateUpdated": "2025-07-30T14:46:14.101Z", "dateReserved": "2025-04-16T15:24:37.089Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-07-29T23:36:00.631Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "18.6", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "iPadOS", "vendor": "Apple", "versions": [{"lessThan": "17.7.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2A4A63D-08FE-4021-8059-FB290A7F398A", "versionEndExcluding": "17.7.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E56FF85-7920-40F5-BF37-32C8C839CCC8", "versionEndExcluding": "18.6", "versionStartIncluding": "18.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD9D42A7-DE2A-4D5A-8C7B-002A60148483", "versionEndExcluding": "18.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed."}, {"lang": "es", "value": "El problema se solucion\u00f3 a\u00f1adiendo l\u00f3gica adicional. Este problema est\u00e1 corregido en iPadOS 17.7.9, iOS 18.6 y iPadOS 18.6. Es posible que los indicadores de privacidad para el acceso al micr\u00f3fono o la c\u00e1mara no se muestren correctamente."}], "id": "CVE-2025-43217", "lastModified": "2026-06-17T09:23:30.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43217", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-30T14:46:04.375783Z", "version": "2.0.3"}}]}, "published": "2025-07-30T00:15:33.827", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/124147"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/124148"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Jul/30"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Jul/31"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-359"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T00:34:21.701049+00:00", "value": {"mitigation_remediation": ["Upgrade the device to iOS 18.6, iPadOS 18.6, or iPadOS 17.7.9 or later for the fix", "Verify that the microphone and camera icons appear correctly when the respective hardware is in use", "Keep the operating system current by enabling automatic updates and regularly checking Apple support for related advisories"], "summary": {"action": "Apply Update", "impact": "Inaccurate privacy indicators may lead to users unaware of active camera or microphone usage"}, "threat_synthesis": {"affected_systems": "Apple\u2019s iOS and iPadOS operating systems are affected. The issue exists in all releases prior to iOS 18.6 and iPadOS 18.6, as well as iPadOS 17.7.9 and earlier. Users running older firmware versions should be aware of this limitation.", "description_and_impact": "A coding oversight in Apple\u2019s privacy indicator logic caused the visual alerts for active microphone or camera usage to be displayed incorrectly. As a result, users could be unaware that their device is capturing audio or video, which could be exploited for covert data collection. The weakness is a security feature failure that undermines user trust and consent mechanisms.", "risk_and_exploitability": "The CVSS score of 4 reflects a low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no remote exploitation vectors are documented. The attack vector is inferred to be local\u2014an attacker would need to trigger a scenario where the user\u2019s privacy indicator is expected to reflect activity, but it fails to do so, allowing covert collection. Although the impact is primarily on privacy and user awareness, it does not compromise system integrity or allow further exploitation."}}}}, "created": "2025-07-30T10:13:56.149949+00:00", "title": "Inaccurate Microphone and Camera Privacy Indicator Display", "updated": "2026-04-28T00:45:17.160275+00:00", "vendors": ["apple", "apple$PRODUCT$ios", "apple$PRODUCT$ipados"]}