PT-2025-5841 · Apphousekitchen · Apphousekitchen Aldente Charge Limiter

Winslow1984 · Published 2025-02-06 · Updated 2025-02-06 · CVE-2025-1078

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: AppHouseKitchen AlDente Charge Limiter versions up to 1.29

Description: A critical issue has been found in AppHouseKitchen AlDente Charge Limiter, affecting the shouldAcceptNewConnection function of the com.apphousekitchen.aldente-pro.helper file in the XPC Service component. This leads to improper authorization, allowing an attack to be launched on the local host.

Recommendations: For AppHouseKitchen AlDente Charge Limiter versions up to 1.29, upgrade to version 1.30 to address this issue. As a temporary workaround, consider disabling the shouldAcceptNewConnection function until the update is applied. Restrict access to the XPC Service component to minimize the risk of exploitation.

Exploit

Fix

LPE

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-1078

Affected Products

Apphousekitchen Aldente Charge Limiter

References · 10

• 🔥 https://winslow1984.com/books/cve-collection/page/aldente-charge-limiter-130-unauthorized-privileged-hardware-operations · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1078 · Security Note
• https://vuldb.com/?ctiid.294844 · Note
• https://twitter.com/WolfgangSesin/status/1887481205047611516 · Twitter Post
• https://twitter.com/senzee1984/status/1887592324621901856 · Twitter Post
• https://t.me/cvedetector/17407 · Telegram Post
• https://vuldb.com/?submit.492529 · Note
• https://twitter.com/VulmonFeeds/status/1887555097133003233 · Twitter Post
• https://twitter.com/CVEnew/status/1887550088119005239 · Twitter Post
• https://vuldb.com/?id.294844 · Note