CVE-2025-65842

{
  "id": "CVE-2025-65842",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-03T17:15:54.317",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. The service accepts XPC connections from any local process without validating the client's identity, and its authorization logic incorrectly calls AuthorizationCopyRights with a NULL reference, causing all authorization checks to succeed. The executeCommand:authorization:withReply: method then interpolates attacker-controlled input into NSTask and executes it with root privileges. A local attacker can exploit these weaknesses to run arbitrary commands as root, create persistent backdoors, or obtain a fully interactive root shell."
    },
    {
      "lang": "es",
      "value": "El servicio XPC privilegiado Aquarius HelperTool (1.0.003) en macOS contiene múltiples fallos que permiten la escalada de privilegios local. El servicio acepta conexiones XPC de cualquier proceso local sin validar la identidad del cliente, y su lógica de autorización llama incorrectamente a AuthorizationCopyRights con una referencia NULL, lo que provoca que todas las comprobaciones de autorización tengan éxito. El método executeCommand:authorization:withReply: luego interpola la entrada controlada por el atacante en NSTask y la ejecuta con privilegios de root. Un atacante local puede explotar estas debilidades para ejecutar comandos arbitrarios como root, crear puertas traseras persistentes u obtener un shell de root completamente interactivo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-05T19:05:35.809969Z",
          "id": "CVE-2025-65842",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-266"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:acustica-audio:aquarius_helpertool:1.0.003:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EA89156-5C87-474C-92A2-CDA92F828BAB"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://almightysec.com/helpertool-xpc-service-local-privilege-escalation/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}