MediumPublic exploit

AirPlay access control bypass allowing unauthenticated commands without pairing

IdentifiersCVE-2025-24271CWE-284

CVE-2025-24271 is an access control flaw in Apple AirPlay. According to Apple, an unauthenticated user on the same network as a signed-in Mac could send AirPlay commands to the device without completing pairing. The issue was addressed with improved access restrictions in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, tvOS 18.4, and visionOS 2.4. Third-party reporting on the AirBorne vulnerability set characterizes this CVE as an ACL/access-control weakness in AirPlay that removes the expected pairing barrier for command delivery from a local-network attacker.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a same-network unauthenticated attacker to issue AirPlay commands to a signed-in Mac without pairing. This constitutes an authentication/access-control bypass on the local network. On its own, the issue enables unauthorized control of AirPlay functionality; reporting also indicates it can be chained with other vulnerabilities, including CVE-2025-24137, to achieve one-click remote code execution in some scenarios. More broadly, this can facilitate unauthorized device interaction and serve as a stepping stone for further compromise within the AirBorne attack chains.

Mitigation

If you can’t patch tonight, do this now.

Until patching is complete, reduce AirPlay exposure by disabling AirPlay/AirPlay Receiver when not needed, restricting which users or devices may access AirPlay, and avoiding permissive configurations on untrusted networks. Limit attacker proximity by segmenting or hardening local Wi-Fi networks, especially public or shared networks, and prevent untrusted devices from joining the same network as AirPlay-capable systems.

Remediation

Patch, then assume compromise.

Apply Apple's security updates that fix CVE-2025-24271: macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, tvOS 18.4, and visionOS 2.4. Ensure all affected Apple devices are updated to the latest available release. Where relevant, also update third-party AirPlay-capable products as vendor patches become available.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2025-24271MaturityPoCVerified exploit

This repository contains a proof-of-concept exploit for CVE-2025-24271, a vulnerability affecting Apple AirPlay on various Apple operating systems (macOS, iOS, iPadOS, tvOS, visionOS). The main script, 'CVE-2025-24271.py', performs mDNS (Bonjour) discovery to locate AirPlay devices on the local network using the zeroconf library. For each discovered device, it sends a crafted HTTP POST request to the '/play' endpoint, referencing a malicious media file hosted at 'http://attacker.local/evil.mov'. The exploit demonstrates the ability to interact with and potentially exploit AirPlay devices by sending unauthorized playback requests. The README provides affected OS versions and a brief description of the vulnerability. The exploit is a network-based POC and does not include a weaponized or customizable payload.

moftenDisclosed Apr 30, 2025pythonnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

AppleIpadosoperating_system

AppleIphone Osoperating_system

AppleMacosoperating_system

AppleTvosoperating_system

AppleVisionosoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

apple supportNews

Jan 25, 2026

About the security content of visionOS 2.4 - Apple Support

An access control issue allowing an unauthenticated user on the same network to send AirPlay commands to a signed-in Mac without pairing (as referenced in Apple Vision Pro security notes).

the hacker newsNews

May 5, 2025

Wormable AirPlay Flaws Enable Zero-Click RCE on Apple Devices via Public Wi-Fi

An AirPlay access control list (ACL) weakness allowing same-network attackers to send AirPlay commands to a signed-in Mac without pairing.

hackreadNews

May 3, 2025

Billions of Apple Devices at Risk from “AirBorne” AirPlay Vulnerabilities

A macOS AirPlay-related one-click remote code execution vulnerability under certain network settings.

security weekNews

Apr 30, 2025

AirPlay Vulnerabilities Expose Apple Devices to Zero-Click Takeover

An access-control-list (ACL) weakness in AirPlay that allows unauthenticated command sending without pairing; described as chainable with another flaw to achieve one-click remote code execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5