PT-2025-48967 · Unknown · Aquarius Helpertool

Simon Bertrand · Published 2025-12-03 · Updated 2025-12-03 · CVE-2025-65842

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Aquarius HelperTool version 1.0.003

Description The Aquarius HelperTool on macOS contains flaws that allow local privilege escalation. The service accepts XPC connections from any local process without validating the client’s identity. Its authorization logic incorrectly calls AuthorizationCopyRights() with a NULL reference, causing all authorization checks to succeed. The executeCommand:authorization:withReply: method then interpolates attacker-controlled input into NSTask and executes it with root privileges. A local attacker can exploit these weaknesses to run arbitrary commands as root, create persistent backdoors, or obtain a fully interactive root shell.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-65842

Affected Products

Aquarius Helpertool

References · 5

• 🔥 https://almightysec.com/helpertool-xpc-service-local-privilege-escalation · Exploit
• https://osv.dev/vulnerability/CVE-2025-65842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65842 · Security Note
• https://twitter.com/CVEnew/status/1996268282630848715 · Twitter Post
• https://t.me/CVEtracker/38767 · Telegram Post