CVE-2025-46286: Apple iOS/iPadOS Face ID备份恢复逻辑漏洞

/* CVE-2025-46286 PoC - Backup Restoration Attack Scenario * Note: This is a conceptual PoC demonstrating the attack flow * Actual exploitation requires physical access or user cooperation */ // Step 1: Create malicious backup configuration const maliciousBackup = { deviceSettings: { faceIdEnabled: true, skipPasswordVerification: true // Exploits validation logic flaw } }; // Step 2: Restore device from backup // When iOS < 26.2 processes this backup: // - Face ID enrollment completes // - Password verification is incorrectly bypassed // - Attacker gains immediate access // Attack Flow: // 1. Attacker creates modified backup // 2. Victim restores device from backup // 3. Face ID enrollment occurs // 4. System fails to enforce password requirement // 5. Attacker accesses device without credentials // Verification: // Check if device is vulnerable: // - iOS version < 26.2 // - Restored from backup // - Face ID just enrolled // - No password prompt displayed