PT-2025-27829 · Unknown · Remote For Mac

Chokri Hammedi · Published 2025-06-08 · Updated 2025-11-12 · CVE-2025-34089

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Remote for Mac versions prior to 2025.7

Description An unauthenticated remote code execution issue exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio. When the application is configured with authentication disabled, the /api/executeScript API endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.

Recommendations Update Remote for Mac to a version later than 2025.7.

Exploit

Fix

RCE

Missing Authentication

Code Injection

Weakness Enumeration

CWE-306

CWE-94

Related Identifiers

BDU:2026-00162

CVE-2025-34089

Affected Products

Remote For Mac

References · 14

• 🔥 https://packetstorm.news/files/id/195347 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/osx/http/remote_for_mac_rce.rb · Exploit
• https://bdu.fstec.ru/vul/2026-00162 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-34089 · Security Note
• https://twitter.com/SecAideInfo/status/1941803097527034227 · Twitter Post
• https://apps.apple.com/us/app/remote-for-mac/id1086962925 · Note
• https://rapid7.com/db/modules/exploit/osx/http/remote_for_mac_rce · Note
• https://apps.apple.com/us/app/remote-for-mac/id1086962925?l=ru · Note
• https://twitter.com/VulmonFeeds/status/1940916554574528543 · Twitter Post
• https://twitter.com/1ZRR4H/status/1988572092959179089 · Twitter Post
• https://vulncheck.com/advisories/remote-for-mac-rce · Note
• https://releasealert.dev/cve/CVE-2025-34089 · Note
• https://twitter.com/CveFindCom/status/1940865789675909252 · Twitter Post
• https://twitter.com/CVEnew/status/1940876699941720070 · Twitter Post