CVE-2025-55177

MEDIUMCISA KEV

5.4

Descripcion

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

Detalles CVE

Puntuacion CVSS v3.15.4

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado8/29/2025

Ultima modificacion10/24/2025

Fuentekev

Avistamientos honeypot0

CISA KEV

VendedorMeta Platforms

ProductoWhatsApp

Nombre vulnerabilidadMeta Platforms WhatsApp Incorrect Authorization Vulnerability

Fecha inclusion KEV2025-09-02

Fecha limite remediacion2025-09-23

Uso en ransomwareUnknown

Productos afectados

whatsapp:whatsappwhatsapp:whatsapp_business

Debilidades (CWE)

CWE-863

Referencias

https://www.facebook.com/security/advisories/cve-2025-55177(cve-assign@fb.com)

https://www.whatsapp.com/security/advisories/2025/(cve-assign@fb.com)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55177(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.