CVE-2025-55177

MEDIUMCISA KEV

5.4

Description

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

CVE Details

CVSS v3.1 Score5.4

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published8/29/2025

Last Modified10/24/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorMeta Platforms

ProductWhatsApp

Vulnerability NameMeta Platforms WhatsApp Incorrect Authorization Vulnerability

KEV Date Added2025-09-02

Remediation Due Date2025-09-23

Ransomware UseUnknown

Affected Products

whatsapp:whatsappwhatsapp:whatsapp_business

Weaknesses (CWE)

CWE-863

References

https://www.facebook.com/security/advisories/cve-2025-55177(cve-assign@fb.com)

https://www.whatsapp.com/security/advisories/2025/(cve-assign@fb.com)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55177(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.