CVE-2025-55177 KEV
5.4
MEDIUM · CVSS 3.1 · EPSS 4.3% (pctl 91)
Patch first
On CISA KEV — known exploited in the wild, due 2025-09-23.
Description
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
Scoring
| CVSS | 5.4 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| EPSS | 4.3% — more likely to be exploited than 91% of all CVEs |
| Weakness | CWE-863 |
| On CISA KEV | yes — remediate by 2025-09-23 |
| Public exploit | none known |
| Published | 2025-08-29 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Meta Platforms WhatsApp Incorrect Authorization Vulnerability |
|---|---|
| Added | 2025-09-02 |
| Due | 2025-09-23 |
| Vendor / product | Meta Platforms / WhatsApp |
| Ransomware use | none reported |
Affected (2)
| Vendor | Product |
|---|---|
| whatsapp business |
References
→ the Explorer · watch your stack · NVD