PrivilegeEscalation

Security Advisory

macOS Security at Risk: PoC Exploit for CVE-2025-24118 Kernel Flaw 

macOS Security at Risk: PoC Exploit for CVE-2025-24118 Kernel Flaw 

A newly discovered race condition in Apple’s macOS kernel (XNU) could allow attackers to escalate privileges, corrupt memory, and potentially achieve kernel-level code execution.

Tracked as CVE-2025-24118 and assigned a CVSS score of 9.8 (Critical), this vulnerability was patched in macOS Sonoma 14.7.3, macOS Sequoia 15.3, and iPadOS 17.7.4.

This vulnerability can be reliably triggered by an unprivileged local attacker using a multi-threaded attack that forces frequent credential updates. 

OEM Apple 
Severity Critical 
CVSS 9.8 
CVEs CVE-2025-24118 
Exploited in Wild No 
Publicly POC Available Yes 
Patch/Remediation Available Yes 
Advisory Version 1.0 

Overview 

A proof-of-concept (PoC) exploit is publicly available, making it critical for users to apply the patch on priority. The vulnerability arises from a race condition in Apple’s XNU kernel due to improper handling of per-thread credentials in read-only structures.

Vulnerability Name CVE ID Product Affected Severity 
 Race Condition Vulnerability  CVE-2025-24118   Apple  Critical 

Technical Summary 

This issue results from a combination of Safe Memory Reclamation (SMR), per-thread credentials, read-only page mappings and memcpy behavior, leading to unauthorized credential modification. 

CVE ID System Affected Vulnerability Details Impact 
CVE-2025-24118  macOS Sonoma prior to 14.7.3  
macOS Sequoia prior to 15.3 
iPadOS prior to 17.7.4   		A concurrency issue in XNU kernel allows corruption of a thread’s kauth_cred_t credential pointer through a non-atomic memory update. This results in a time-of-check to time-of-use (TOCTOU) race condition. Privilege escalation, memory corruption, potential kernel-level code execution  

Remediation: 

  • Patch Installation: Users should upgrade to macOS Sonoma 14.7.3, macOS Sequoia 15.3, and iPadOS 17.7.4 to mitigate the risk. 

Conclusion: 

CVE-2025-24118 is a critical race condition vulnerability in Apple’s XNU kernel that allows local attackers to escalate privileges and compromise system integrity. Users and organizations are strongly advised to apply the latest patches provided by Apple to protect against potential exploits.

References: 

Security Advisory

Apple Patched Actively Exploited Zero-Day Vulnerability

Summary

CVE-2025-24085 is a zero-day vulnerability in Apple’s “Core Media framework” which enables malicious applications to potentially gain elevated privileges on impacted devices. It falls under the “Memory Corruption vulnerability category”, posing significant security risks such as unauthorized access to sensitive data or potential device control.

OEM Apple Inc
Severity High
CVEs CVE-2025-24085
Exploited in Wild Yes
Patch/Remediation Available Yes
Advisory Version 1.0

 

Vulnerability Name CVE ID Product Affected Severity Affected Version
  Privilege escalation vulnerability   CVE-2025-24085     Apple     High iPhone-XS and later, macOS Sequoia iPad-Pro (3rd generation and later), iPad Air (3rd generation and later), iPad (7th generation and later), iPad mini (5th generation and later) Apple Watch: Series 6 and later Apple TV: All models

Technical Summary

CVE ID System Affected Vulnerability Details Impact
      CVE-2025-24085   iPhone, iPad, Mac, Apple Watch, Apple TV CVE-2025-24085 is a memory management vulnerability in Apple’s Core Media framework, responsible for processing audio and video content. The vulnerability stems from improper handling of media data, allowing attackers to execute arbitrary code with elevated privileges. It can be remotely exploited through malicious media files, creating significant security risks.   Arbitrary Code Execution, Privilege Escalation, Sensitive Data Exposure, Remote Exploitation via Media Files  

Remediation:

  • Update: Ensure the latest patches are applied to affected Apple devices as listed below
Affected Version(s) Fixes and Releases
iOS 17.2 and later iOS 18.3
iPadOS 17.2 and later iPadOS 18.3
macOS Sequoia (all previous versions) macOS Sequoia 15.3
watchOS 10.3 and later watchOS 11.3
tvOS 17.2 and later tvOS 18.3
visionOS 1.3 and later visionOS 2.3

Apple has fixed this vulnerability in these software versions. Update devices immediately to mitigate the risk of exploitation.

General Recommendations:

  • Untrusted Media: Avoid opening suspicious media files, emails, or links from unknown sources, as the vulnerability can be exploited remotely via malicious media. 
  • Automatic Updates: Enable automatic updates on all Apple devices to ensure timely installation of future security patches. 

References:

Security Advisory

Cisco Meeting Management to Prone to Attack Vectors; Vulnerability CVE-2025-20156 

Cisco has warned about a new privilege escalation vulnerability in its Meeting Management tool that could allow a remote attacker to gain administrator privileges on exposed instances.

The vulnerability, CVE-2025-20156  was disclosed by Cisco on January 22 and is awaiting further analysis by the US National Vulnerability Database (NVD)

OEM Cisco 
Severity Critical 
CVSS 9.9 
CVEs CVE-2025-20156 
Exploited in Wild No 
Patch/Remediation Available Yes 
Advisory Version 1.0 

Overview 

A critical vulnerability (CVE-2025-20156) in Cisco Meeting Management could allow attackers to gain unauthorized administrative access. This issue affects versions prior to 3.9.1 and has been classified as critical. Cisco strongly recommends updating to the latest fixed version to address this risk. 

Vulnerability Name CVE ID Product Affected Severity 
 Privilege Escalation Vulnerability  CVE-2025-20156  Cisco  Critical 

Technical Summary 

A critical security vulnerability has been identified in Cisco Meeting Management. This flaw resides in the REST API and stems from improper enforcement of authorization protocols for REST API users. Remote, authenticated attackers with low-level privileges can exploit this issue by sending specially crafted API requests to specific endpoints. A successful exploit could allow attackers to escalate their privileges to administrator level and gain control over edge nodes managed by Cisco Meeting Management. 

CVE ID System Affected Vulnerability Details Impact 
CVE-2025-20156  Cisco Meeting Management  prior to version 3.9.1 Insufficient authorization checks in the REST API allow attackers to send crafted API requests to escalate privileges.  Attackers can gain full administrative control and disrupt business operations.  

Remediation: 

  1. Update to the Latest Version: 
  • Upgrade Cisco Meeting Management to version 3.9.1or later. 
  1. Regular Security Practices: 
  • Monitor Cisco’s security advisories. 
  • Regularly update systems to address emerging threats. 

Conclusion: 

CVE-2025-20156 poses a critical risk to Cisco Meeting Management users. Exploiting this flaw could disrupt operations by granting attacker’s administrative control. Immediate updates are crucial to mitigate the risk and protect affected systems. 

References: 

  • https://cybersecuritynews.com/cisco-meeting-management-vulnerability/ 

Security Advisory

Privilege Escalation Vulnerability in ComboBlocks Plugin Affects Thousands of Sites

A critical vulnerability in the ComboBlocks WordPress plugin (formerly Post Grid and Gutenberg Blocks) exposes over 40,000 websites to potential complete takeover by unauthenticated attackers. This vulnerability exists due to improper handling of user meta during the registration process, enabling privilege escalation. It affects versions 2.2.85 to 2.3.3 and has been addressed in version 2.3.4.

OEM

WordPress

Severity

Critical

Date of Announcement

2025-01-17

CVSS score

9.8

CVE

CVE-2024-9636

Exploited in Wild

No

Patch/Remediation Available

Yes 

Advisory Version

1.0

Overview

ComboBlocks, a plugin designed to enhance website design and functionality, was found to have a critical security flaw (CVE-2024-9636) that could allow unauthenticated attackers to register as administrators, granting them full control over the affected websites.

Vulnerability Name

CVE ID

Product Affected

Severity

CVSS Score

Unauthenticated Privilege Escalation
Vulnerability

 CVE-2024-9636

ComboBlocks WordPress Plugin

Critical

9.8

Technical Summary

CVE ID

System Affected

Vulnerability Details

Impact

CVE-2024-9636

ComboBlocks plugin (2.2.85 - 2.3.3)

The vulnerability stems from improper restriction of user meta updates during profile registration. This flaw allows unauthenticated attackers to register as administrators, granting them full control over the website.


Complete website takeover and malware injection.

Remediations

  1. Update Plugin: Immediately update the ComboBlocks plugin to version 2.3.4 or later.
  2. Review Administrative Accounts:
  • Audit all user accounts with administrative privileges.
  • Revoke any unauthorized access.
  1. Enhance Security Posture:
  • Enable multi-factor authentication (MFA) for all admin accounts.
  • Restrict user permissions based on the principle of least privilege.
  • Use a web application firewall (WAF) to filter and block malicious traffic.
  1. Monitor and Log Activity:
  • Activate detailed logging for user registration and privilege changes.
  • Configure alerts for unusual activity, such as mass registrations or privilege escalations.
  1. Implement Preventative Measures:
  • Regularly update all plugins and themes.
  • Backup the WordPress site frequently to ensure quick recovery in case of any compromise.

References

Scroll to top