PT-2025-25173 · Archify · Archify

Carlos Garrido · Published 2025-06-10 · Updated 2025-06-11 · CVE-2024-9062

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Archify (affected versions not specified)

Description The issue is related to insufficient client validation in the privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. This tool is responsible for privileged operations such as arbitrary file deletion and file permission changes. However, it does not verify the code signature, entitlements, or signing flags of the connecting client, allowing any local process to establish a connection and invoke privileged functionality. This leads to unauthorized execution of actions with root-level privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-9062

Affected Products

Archify

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-9062 · Security Note
• https://pentraze.com/vulnerability-reports · Note
• https://t.me/latest_high_impact_cve/2606 · Telegram Post
• https://t.me/latest_high_impact_cve/2605 · Telegram Post
• https://t.me/cvetracker/25983 · Telegram Post
• https://twitter.com/CVEnew/status/1932584555417870449 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1932679239116914985 · Twitter Post
• https://pentraze.com · Note