« Volver al listado

CVE-2025-43270

Estado: ModificadaAlta (8.8)—

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may gain unauthorized access to Local Network.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L/PR:L (acceso local con privilegios) sin interacción apunta a T1068. Sandbox bypass permite acceso a Local Network, revelando información (T1552.001) y potencial exfiltración (T1020).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingThreat Intelligence ProgramRestrict File and Directory PermissionsPassword PoliciesExecution PreventionAudit

Tecnologías afectadas (1)

Apple — Macos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-43270",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-43270",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-31T03:55:59.538212Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "Apple",
          "product": "macOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "13.7.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "14.7.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "15.6",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-30T00:15:38.143",
  "references": [
    {
      "url": "https://support.apple.com/en-us/124149",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/124150",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/124151",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2025/Jul/32",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2025/Jul/33",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2025/Jul/34",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may gain unauthorized access to Local Network."
    },
    {
      "lang": "es",
      "value": "Se solucionó un problema de acceso con restricciones adicionales en el entorno de pruebas. Este problema se solucionó en macOS Sequoia 15.6, macOS Ventura 13.7.7 y macOS Sonoma 14.7.7. Una aplicación podría obtener acceso no autorizado a la red local."
    }
  ],
  "lastModified": "2026-06-17T09:23:37.937",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32DF9916-8A45-426F-BA36-FC73FD668828",
              "versionEndExcluding": "13.7.7"
            },
            {
              "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F043DE0-C517-463D-9693-53789EB6132D",
              "versionEndExcluding": "14.7.7",
              "versionStartIncluding": "14.0"
            },
            {
              "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CF17CE2-DB4B-48D1-81AF-67EF1EC7BB45",
              "versionEndExcluding": "15.6",
              "versionStartIncluding": "15.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@apple.com"
}