CVE-2025-34089 json
Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection
published 2025-07-03 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-19900
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 1
- Metasploit
Summary
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allow unknown devices" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.
Timeline
- First public exploit (Metasploit exploit/osx/http/remote_for_mac_rce)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 16 mo ago
Exploit prediction
2.35% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/osx/http/remote_for_mac_rce Remote for Mac Unauthenticated RCE metasploit exploit, normal rank, 2025-05-27
- raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/osx/http/remote_for_mac_rce.rb referenced PoC, tagged "exploit" by a source, unverified
- packetstorm.news https://packetstorm.news/files/id/195347 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Aexol Studio Remote for Mac
Classification
References
-
raw.githubusercontent.com
/rapid7/metasploit-framework/master/modules/exploits/osx/http/remote_for_mac_rce.rb
exploit
-
packetstorm.news
/files/id/195347
exploit
-
rapid7.com
/db/modules/exploit/osx/http/remote_for_mac_rce/
third-party-advisory
-
apps.apple.com
/us/app/remote-for-mac/id1086962925
product
-
vulncheck.com
/advisories/remote-for-mac-rce
third-party-advisory
Sources
- CVE List CVE-2025-34089
- NVD CVE-2025-34089
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.