CVE-2025-46286

/* CVE-2025-46286 PoC - Backup Restoration Attack Scenario * Note: This is a conceptual PoC demonstrating the attack flow * Actual exploitation requires physical access or user cooperation */ // Step 1: Create malicious backup configuration const maliciousBackup = { deviceSettings: { faceIdEnabled: true, skipPasswordVerification: true // Exploits validation logic flaw } }; // Step 2: Restore device from backup // When iOS < 26.2 processes this backup: // - Face ID enrollment completes // - Password verification is incorrectly bypassed // - Attacker gains immediate access // Attack Flow: // 1. Attacker creates modified backup // 2. Victim restores device from backup // 3. Face ID enrollment occurs // 4. System fails to enforce password requirement // 5. Attacker accesses device without credentials // Verification: // Check if device is vulnerable: // - iOS version < 26.2 // - Restored from backup // - Face ID just enrolled // - No password prompt displayed

{"cve": {"id": "CVE-2025-46286", "sourceIdentifier": "[email protected]", "published": "2026-01-09T22:15:59.407", "lastModified": "2026-01-14T17:46:11.003", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a backup may prevent passcode from being required immediately after Face ID enrollment."}, {"lang": "es", "value": "Se abordó un problema de lógica con validación mejorada. Este problema se corrigió en iOS 26.2 y iPadOS 26.2. Restaurar desde una copia de seguridad puede impedir que se requiera el código inmediatamente después de la inscripción de Face ID."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-288"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2", "matchCriteriaId": "EA029506-5678-444B-93B5-27DAD643A1C0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2", "matchCriteriaId": "6276FDCA-3407-4FDD-8437-B57C98A97084"}]}]}], "references": [{"url": "https://support.apple.com/en-us/125884", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}]}}