{"id":"CVE-2025-55177","kind":"vulnerability","aliases":["CVE-2025-55177"],"related":[],"title":"Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73,…","description":"Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.","summary":"WhatsApp fails to fully check authorization on synchronization messages sent to linked devices. An unrelated user can make a target's device process content fetched from an arbitrary URL.","severity":"medium","cvss":5.4,"epss":null,"exploited":true,"exploited_at":"2025-09-02T00:00:00+00:00","products":[{"name":"Meta Platforms WhatsApp","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"whatsapp","fixed":["2.25.21.73"],"affected":">= 2.22.25.2, < 2.25.21.73","ecosystem":"vendor"},{"name":"whatsapp","fixed":["2.25.21.78"],"affected":">= 2.22.25.2, < 2.25.21.78","ecosystem":"vendor"},{"name":"whatsapp business","fixed":["2.25.21.78"],"affected":">= 2.22.25.2, < 2.25.21.78","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["end-users","exploited","linked-devices","vendor","whatsapp"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigations from Meta; update WhatsApp on all linked devices to the current release. Exact fixed versions are unknown from the sources.","status":"open","published_at":"2025-08-29T16:15:36+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:27+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:46:27Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations from Meta; update WhatsApp on all linked devices to the current release. Exact fixed versions are unknown from the sources.","reach":"internet","summary":"WhatsApp fails to fully check authorization on synchronization messages sent to linked devices. An unrelated user can make a target's device process content fetched from an arbitrary URL.","category":"vendor","who_cares":["whatsapp","linked-devices","end-users"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker makes target device fetch and process content from an arbitrary URL.","analyst_note":"Confirm fixed WhatsApp client versions and linked-device details from Meta's advisory; the CISA KEV entry is the only source given.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000426,"input_tokens":2581,"output_tokens":336,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':16A,19A,127C '-43300':128C '-55177':17A,20A 'allow':92C 'appl':124C 'arbitrari':64B,103C 'assess':111C 'attack':136C 'author':2A,42B,67C 'busi':81C 'business':27A 'check':41B 'combin':116C 'content':60B,100C 'could':90C 'cve':15A,18A,126C 'devic':5A,34B,49B,58B,70C,109C 'end':29B 'end-us':28B 'exploit':31B,132C 'fail':38B 'fetch':61B 'fulli':40B 'incomplet':1A,66C 'io':11A,76C,83C 'level':121C 'link':4A,33B,48B,69C 'linked-devic':32B 'mac':88C 'make':54B 'may':129C 'messag':7A,45B,72C 'meta':21A 'os':120C 'os-level':119C 'platform':125C 'platforms':22A 'prior':12A,77C 'process':59B,98C 'sent':46B 'sophist':135C 'specif':138C 'synchron':6A,44B,71C 'target':56B,107C,139C 'trigger':97C 'unrel':51B,94C 'url':65B,104C 'user':30B,52B,95C,140C 'v2.25.21.73':14A,79C 'v2.25.21.78':84C,89C 'vendor':35B 'vulner':114C,122C 'whatsapp':9A,23A,24A,25A,26A,36B,37B,74C,80C,86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-08-29T16:15:36+00:00","kev":{"dateAdded":"2025-09-02","dueDate":"2025-09-23","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"cve-assign@fb.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-55177","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-55177","severity":null,"published_at":"2025-09-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-55177","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55177","severity":null,"published_at":"2025-08-29T16:15:36+00:00","modified_at":"2026-10-18T21:10:00+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}