CVE-2025-65841

{
  "id": "CVE-2025-65841",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-03T17:15:54.170",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in the local file ~/Library/Application Support/Aquarius/aquarius.settings using a weak obfuscation scheme. The password is \"encrypted\" through predictable byte-substitution that can be trivially reversed, allowing immediate recovery of the plaintext value. Any attacker who can read this settings file can fully compromise the victim's Aquarius account by importing the stolen configuration into their own client or login through the vendor website. This results in complete account takeover, unauthorized access to cloud-synchronized data, and the ability to perform authenticated actions as the user."
    },
    {
      "lang": "es",
      "value": "Aquarius Desktop 3.0.069 para macOS almacena credenciales de autenticación de usuario en el archivo local ~/Library/Application Support/Aquarius/aquarius.settings utilizando un esquema de ofuscación débil. La contraseña está “cifrada” mediante sustitución de bytes predecible que puede revertirse trivialmente, permitiendo la recuperación inmediata del valor en texto plano. Cualquier atacante que pueda leer este archivo de configuración puede comprometer completamente la cuenta de Aquarius de la víctima importando la configuración robada en su propio cliente o iniciando sesión a través del sitio web del proveedor. Esto resulta en una toma de control completa de la cuenta, acceso no autorizado a datos sincronizados en la nube y la capacidad de realizar acciones autenticadas como el usuario."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-05T19:01:08.695475Z",
          "id": "CVE-2025-65841",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:acustica-audio:aquarius:3.0.069:*:*:*:*:macos:*:*",
              "matchCriteriaId": "84EDA348-8E6E-4E48-80EE-8A0E58105B4D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://almightysec.com/account-takeover-via-weak-encryption/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}