Security Vulnerability Report
中文
CVE-2025-43449 CVSS 7.5 HIGH

CVE-2025-43449

Published: 2025-11-04 02:15:51
Last Modified: 2025-11-04 18:47:36

Description

The issue was addressed with improved handling of caches. This issue is fixed in iOS 26.1 and iPadOS 26.1. A malicious app may be able to track users between installs.

CVSS Details

CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* - VULNERABLE
Apple iOS < 26.1
Apple iPadOS < 26.1

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-43449 PoC - Conceptual Proof of Concept // This is a conceptual demonstration of the cache tracking vulnerability // DO NOT use for malicious purposes // Simulated malicious app attempting to access cached user data class CacheTrackingPoC { // Target cache keys that may contain user identifiers private static final String[] CACHE_KEYS = { "user_device_id", "user_session_token", "user_behavior_cache", "app_installation_id", "user_preference_cache" }; public static void main(String[] args) { System.out.println("CVE-2025-43449 Cache Tracking Vulnerability PoC"); System.out.println("Target: Apple iOS/iPadOS < 26.1"); // Attempt to access system cache for (String key : CACHE_KEYS) { try { // Simulated cache access attempt Object cachedData = accessSystemCache(key); if (cachedData != null) { System.out.println("[+] Retrieved: " + key); System.out.println(" Data: " + cachedData.toString()); // Track user across installs using cached identifier trackUserAcrossInstalls(cachedData); } } catch (SecurityException e) { System.out.println("[-] Blocked accessing: " + key); } } } private static Object accessSystemCache(String key) { // Simulated cache access - actual exploitation requires iOS environment // Vulnerable condition: cache not properly isolated between apps return null; // Returns cached user data if vulnerability exists } private static void trackUserAcrossInstalls(Object identifier) { // Use cached identifier to track user across different app installations System.out.println("[!] User tracking established with ID: " + identifier); } } // Note: Actual exploitation requires: // 1. Malicious iOS app with cache access permissions // 2. Exploitation of improper cache isolation in iOS < 26.1 // 3. Network access to transmit collected data to attacker server

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-43449", "sourceIdentifier": "[email protected]", "published": "2025-11-04T02:15:50.640", "lastModified": "2025-11-04T18:47:36.087", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved handling of caches. This issue is fixed in iOS 26.1 and iPadOS 26.1. A malicious app may be able to track users between installs."}, {"lang": "es", "value": "El problema se abordó con un manejo mejorado de cachés. Este problema está solucionado en iOS 26.1 y iPadOS 26.1. Una aplicación maliciosa podría rastrear usuarios entre instalaciones."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.1", "matchCriteriaId": "6D51AEDC-9086-4010-B3BF-C652D65D09C8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.1", "matchCriteriaId": "3981A7BE-BC98-4C6F-AE38-D68839368925"}]}]}], "references": [{"url": "https://support.apple.com/en-us/125632", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}]}}