U.S. CISA adds Apple iOS and iPadOS and Mitel SIP Phones flaws to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-41710 | Argument Injection RCE in Mitel 6800/6900/6900w Series SIP Phones CVE-2024-41710 is an argument injection vulnerability (CWE-88) affecting Mitel 6800 Series, 6900 Series, and 6900w Series SIP phones, including the 6970 Conference Unit, caused by insufficient sanitization of parameters processed during the device's boot process. An attacker who can supply crafted arguments to the boot process can inject and execute arbitrary commands within the context of the phone's system. Organizations deploying these enterprise desk phones are affected; the available data does not specify affected or fixed firmware version ranges. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-02-12, confirming exploitation in the wild, though no public proof-of-concept is known and any ransomware association is unconfirmed. EPSS assigns a 41.6% probability of exploitation within the next 30 days (99th percentile), so remediation should be treated as urgent. Do: Update affected 6800/6900/6900w series phones to the fixed firmware per Mitel's security advisory and reboot the phones so they boot with patched firmware, since the flaw is in the boot process; if fixed firmware is unavailable, apply Mitel's mitigations or discontinue use per the CISA KEV required action. Check whether phone management or provisioning interfaces are reachable from untrusted networks and restrict that access. Given KEV-listed exploitation and a 99th-percentile EPSS score, prioritize remediation, and note federal agencies are required to act under the KEV deadline. | 7.2 | 42% | KEV PoC |
| largeon the order of 100,000+ deployed handsets globally (enterprise VoIP installed base estimate; internet-exposed subset likely smaller) | |
| CVE-2025-24200 | Incorrect Authorization in Apple iOS/iPadOS Lets Attackers Disable USB Restricted Mode CVE-2025-24200 is an incorrect authorization flaw (CWE-863) in Apple iOS and iPadOS, caused by an authorization issue in state management that Apple resolved with improved state handling. An attacker with brief physical access to a locked device can exploit the flaw to disable USB Restricted Mode, the feature that locks down a locked iPhone or iPad's USB data port against accessories after a set period. This allows USB accessories, including data-extraction and attack peripherals, to communicate with the device while it remains locked, with a high confidentiality and integrity impact (CVSS 6.1, physical attack vector). Any iPhone or iPad user running a version prior to the applicable fixed release is affected, with fixes shipped in iOS 15.8.4, iOS 16.7.11, iOS 18.3.1, iPadOS 15.8.4, iPadOS 16.7.11, iPadOS 17.7.5, and iPadOS 18.3.1. Apple reports the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-12. Do: Update iPhones to iOS 15.8.4, iOS 16.7.11, or iOS 18.3.1 and iPads to iPadOS 15.8.4, 16.7.11, 17.7.5, or 18.3.1 as applicable to each device's branch, checking Settings > General > Software Update for unmanaged devices. Because exploitation requires physical access, prioritize high-risk users (executives, journalists, government personnel), confirm no fleet devices remain on unpatched builds, and avoid untrusted USB accessories and charging ports until updated. CISA's KEV listing requires federal agencies to apply the vendor patch per the required action or discontinue use of the product. | 6.1 | 4% | KEV |
| mass≈1 billion+ devices (Apple's active installed base; every iPhone/iPad running a pre-patch iOS/iPadOS release at the time of disclosure) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 6.4.0.136 | es, including the 6970 Conference Unit through R6.4.0.HF1 (R6.4.0.136). In mid-July 2024, Mitel addressed the vulnerability with |
Full article704 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 15, 2025
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple iOS and iPadOS and Mitel SIP Phones vulnerabilities to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple iOS and iPadOS and Mitel SIP Phones vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
The two vulnerabilities are:
- CVE-2025-24200 Apple iOS and iPadOS Incorrect Authorization Vulnerability
- CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability
This week Apple released emergency security updates to address a zero-day vulnerability, tracked as CVE-2025-24200, that the company believes was exploited in “extremely sophisticated” targeted attacks.
An attacker could have exploited the vulnerability to disable the USB Restricted Mode “on a locked device.”
Apple’s USB Restricted Mode is a security feature introduced in iOS 11.4.1 to protect devices from unauthorized access via the Lightning port.
The USB Restricted Mode disables the data connection of the iPhone’s Lightning port after a specific interval of time, but it doesn’t interrupt the charging process. Any other data transfer would require the user to provide the passcode.
The IT giant fixed the vulnerability with improved state management.
“A physical attack may disable USB Restricted Mode on a locked device,” reads the release notes for iOS 18.3.1 and iPadOS 18.3.1. “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.”
The zero-day impacts the following devices: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later.
Apple also released 17.7.5 to address the issues in iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation.
As usual, Apple did not publicly disclose details about the attacks exploiting the vulnerability or the threat actors responsible. However, the circumstance that the Citizen Lab researchers discovered the attack suggests that the threat actor may have used a zero-day exploit to deliver commercial spyware in highly targeted attacks. Such kinds of attacks often rely on zero-day exploits to target journalists, dissidents, and opposition politicians with spyware. Another possibility is that Apple is aware of physical access attacks on some of its devices, likely involving forensic tools like Cellebrite to unlock and extract data.
The second vulnerability added to the CISA KEV catalog is CVE-2024-41710, which affects Mitel 6800, 6900, and 6900w series SIP phones, including the 6970 Conference Unit through R6.4.0.HF1 (R6.4.0.136).
In mid-July 2024, Mitel addressed the vulnerability with the release of firmware updates. The vendor warned that exploitation of the flaw “could allow an authenticated attacker with administrative privilege to conduct a command injection attack due to insufficient parameter sanitization during the boot process”.
A month later, the PacketLabs researcher Kyle Burns published a PoC exploit code for the vulnerability CVE-2024-41710.
At the end of January, Akamai researchers spotted a new variant of the Mirai-based botnet Aquabot that is targeting vulnerable Mitel SIP phones.
Aquabot is a Mirai-based botnet designed for DDoS attacks. Named after the “Aqua” filename, it was first reported in November 2023.
As this is the third distinct iteration of Aquabot, Akamai tracked this variant as Aquabotv3. The bot targets the command injection vulnerability CVE-2024-41710 that impacts Mitel models.
“This third iteration adds a novel activity for a Mirai-based botnet: C2 communication when the botnet catches certain signals.” reads the report published by Akamai. “This, and other notable differences in functionality, separate the two versions significantly, supporting the distinction of a third variant.”
The malware targets the flaw CVE-2024-41710 that affects Mitel 6800, 6900, and 6900w series SIP phones, including the 6970 Conference Unit through R6.4.0.HF1 (R6.4.0.136).
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by March 5, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/174246/security/u-s-cisa-adds-apple-ios-and-ipados-and-mitel-sip-phones-flaws-to-its-known-exploited-vulnerabilities-catalog.html