CVE-2025-30436: Siri Vulnerability Enabling Auto-Answer Calls on Locked iOS Devices

Overview

In today’s digital age, cybersecurity has become a matter of paramount importance. With the increasing reliance on mobile devices, particularly Apple’s iOS and iPadOS, the need for substantial security measures is undeniable. However, even the most robust systems may have vulnerabilities, such as the recently discovered CVE-2025-30436, which can have severe implications if exploited.
The CVE-2025-30436 vulnerability is a serious security issue affecting Apple’s iOS and iPadOS platforms. It allows attackers to manipulate Siri into enabling Auto-Answer Calls on locked devices, potentially leading to system compromise or data leakage. This vulnerability underscores the continuous need for vigilance in maintaining cybersecurity defenses and ensuring that systems are patched with the latest security updates.

Vulnerability Summary

CVE ID: CVE-2025-30436
Severity: Critical (CVSS: 9.1)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Apple iOS | Prior to 18.4
Apple iPadOS | Prior to 18.4

How the Exploit Works

The exploit hinges on leveraging Siri’s functionality on locked devices. The attacker initiates a request to Siri to enable Auto-Answer Calls. If successful, the attacker can then make a call to the compromised device, which will be automatically answered, granting the attacker potential access to any audio input or output from the device. This could potentially lead to unauthorized eavesdropping or data leakage.

Conceptual Example Code

While the vulnerability is not exploited through traditional code, the exploitation process could conceptually be represented as follows:

BEGIN
Request Siri on target device: "Enable Auto-Answer Calls"
IF request is successful
Initiate call to target device
IF call is auto-answered
Access to device's audio input/output is granted
END IF
END IF
END

It’s important to note that the actual exploitation process would involve specific spoken commands and potentially sophisticated voice manipulation techniques, rather than the simple programmatic approach outlined above.
The mitigation for this vulnerability is straightforward: apply the vendor-supplied patch in iOS 18.4 or iPadOS 18.4. If this is not possible, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could be used as a temporary mitigation strategy. However, these are not full-proof solutions and the best course of action is updating the system to the latest version.