Security readout for executives and security teams
Plain-English summary
This Apple iOS and iPadOS issue allowed an app to install a VPN configuration without the user granting permission. That matters because VPN settings can affect how device traffic is routed. Apple says the issue was fixed in iOS 15 and iPadOS 15.
Executive priority
Prioritize remediation for mobile users handling sensitive traffic or operating outside managed networks. This is not supported as an emergency exploitation case by the provided sources, but unauthorized VPN configuration changes can create meaningful data-routing risk.
Technical view
CVE-2021-30874 is an authorization flaw in iOS and iPadOS. Apple addressed it with improved state management. The public record does not provide CVSS, CWE, exact vulnerable version ranges, or technical detail beyond unauthorized VPN configuration installation by an app.
Likely exposure
Exposure is most likely on iPhone or iPad devices running versions before the Apple fixes in iOS 15 and iPadOS 15. The sources do not enumerate exact affected versions or device models.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not listed as KEV. Public evidence only supports the possibility that an app could install a VPN configuration without user permission.
Researcher notes
The public data is sparse: no CVSS vector, CWE, affected version list, exploit detail, or workaround is provided. Treat Apple’s fixed-in statement as the authoritative remediation anchor and avoid assuming broader impact without additional vendor evidence.
Mitigation direction
- Update affected devices to iOS 15 or iPadOS 15, or later supported releases.
- Check Apple security guidance for any device-specific update constraints.
- Remove unexpected VPN configurations from managed and unmanaged devices.
- Restrict installation of untrusted apps, especially on unmanaged mobile devices.
- Use MDM policy to monitor or control VPN profile changes where available.
Validation and detection
- Inventory iOS and iPadOS device versions across the organization.
- Identify devices still below iOS 15 or iPadOS 15.
- Review VPN configuration profiles for unexpected or unauthorized entries.
- Confirm Apple advisory coverage for deployed device models and OS versions.
- Check MDM logs for unusual VPN profile creation or modification events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-30874 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/HT212814CVE reference · x_refsource_MISC
- https://support.apple.com/kb/HT212869CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.