CVE-2025-43360

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43360", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-16T15:24:37.112Z", "datePublished": "2025-11-04T01:16:12.112Z", "dateUpdated": "2026-04-02T18:14:36.970Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Password fields may be unintentionally revealed"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved UI. This issue is fixed in iOS 26 and iPadOS 26. Password fields may be unintentionally revealed."}], "references": [{"url": "https://support.apple.com/en-us/125108"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:14:36.970Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T15:36:24.683772Z", "id": "CVE-2025-43360", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-01T19:24:09.800Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-43360", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T15:36:24.683772Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T15:36:55.926Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "0", "lessThan": "26", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/125108"}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved UI. This issue is fixed in iOS 26 and iPadOS 26. Password fields may be unintentionally revealed."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Password fields may be unintentionally revealed"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:14:36.970Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43360", "state": "PUBLISHED", "dateUpdated": "2026-04-02T18:14:36.970Z", "dateReserved": "2025-04-16T15:24:37.112Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-11-04T01:16:12.112Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "26", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4221CFD-0208-42B8-AACA-1BE6AEC3BA9A", "versionEndExcluding": "26.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "68DCA17A-424E-4EE3-B005-0F2E42407226", "versionEndExcluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved UI. This issue is fixed in iOS 26 and iPadOS 26. Password fields may be unintentionally revealed."}, {"lang": "es", "value": "El problema se abord\u00f3 con una UI mejorada. Este problema est\u00e1 solucionado en iOS 26 y iPadOS 26. Los campos de contrase\u00f1a pueden ser revelados involuntariamente."}], "id": "CVE-2025-43360", "lastModified": "2026-06-17T09:23:50.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43360", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T15:36:24.683772Z", "version": "2.0.3"}}]}, "published": "2025-11-04T02:15:43.570", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/125108"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:21:55.739071+00:00", "value": {"mitigation_remediation": ["Upgrade the device to iOS\u00a026 or iPadOS\u00a026 to apply the official UI fix that prevents passwords from being unintentionally revealed.", "If an update cannot be applied immediately, avoid using password fields in publicly viewable screens and disable any third\u2011party apps that may expose secure input elements.", "Closely monitor Apple\u2019s security advisories for any new patches or further guidance related to password field disclosure."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The flaw affects all Apple iOS and iPadOS devices running a version older than 26. Users whose devices have not been upgraded remain susceptible, while devices updated to iOS\u00a026 or iPadOS\u00a026 incorporate the UI fix that prevents inadvertent password exposure.", "description_and_impact": "The vulnerability is a graphical user interface flaw that may allow password fields to be unintentionally exposed, potentially revealing user credentials to local processes or a malicious observer. The issue was resolved in iOS 26 and iPadOS 26, and Apple marked it as an information\u2011disclosure flaw with a CVSS score of 5.5, indicating moderate confidentiality impact.", "risk_and_exploitability": "The EPSS score is less than 1%, and the vulnerability is not included in the CISA KEV catalog, suggesting a low likelihood of large\u2011scale exploitation. Nevertheless, the disclosure of passwords presents a significant privacy risk, especially if an attacker can manipulate the UI or capture the screen. The CVSS of 5.5 reflects a moderate risk that should prompt prompt remediation once the update becomes available."}}}}, "created": "2025-11-04T16:34:24.015670+00:00", "title": "Unintended Password Field Disclosure in iOS and iPadOS", "updated": "2026-04-27T23:30:15.500795+00:00", "vendors": ["apple", "apple$PRODUCT$ios", "apple$PRODUCT$ipad_os"]}