PT-2025-4295 · Stats · Stats

Senzee1984

·

Published

2025-01-17

·

Updated

2025-02-06

·

CVE-2025-21606

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions Stats versions prior to 2.11.21
Description The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name eu.exelban.Stats.SMC.Helper. The associated binary, eu.exelban.Stats.SMC.Helper, is a privileged helper tool designed to execute actions requiring elevated privileges on behalf of the client, such as setting fan modes, adjusting fan speeds, and executing the powermetrics command. The root cause of this vulnerability lies in the shouldAcceptNewConnection method, which unconditionally returns YES (or true), allowing any XPC client to connect to the service without any form of verification. As a result, unauthorized clients can establish a connection to the Mach service and invoke methods exposed by the HelperTool interface. An attacker can exploit this vulnerability to modify the hardware settings of the user’s device and execute arbitrary code with root privileges.
Recommendations For versions prior to 2.11.21, upgrade to version 2.11.21 to address the vulnerability. As a temporary workaround, consider disabling the shouldAcceptNewConnection method or restricting access to the eu.exelban.Stats.SMC.Helper service until a patch is available. Avoid using the powermetrics command in the affected API endpoint until the issue is resolved.

Exploit

Fix

LPE

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2025-21606
GHSA-QWHF-PX96-7F6V

Affected Products

Stats