CVE-2025-34089 json
Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection
published last yr. modified 4mo ago also EUVD-2025-19900
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 1
- Metasploit
Summary
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allow unknown devices" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.
Is CVE-2025-34089 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (Metasploit exploit/osx/http/remote_for_mac_rce)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
2.35% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/osx/http/remote_for_mac_rce Remote for Mac Unauthenticated RCE metasploit exploit, normal rank, 2025-05-27
- raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/osx/http/remote_for_mac_rce.rb referenced PoC, tagged "exploit" by a source, unverified
- packetstorm.news https://packetstorm.news/files/id/195347 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Aexol Studio Remote for Mac
Classification
References
-
raw.githubusercontent.com
/rapid7/metasploit-framework/master/modules/exploits/osx/http/remote_for_mac_rce.rb
exploit
-
packetstorm.news
/files/id/195347
exploit
-
rapid7.com
/db/modules/exploit/osx/http/remote_for_mac_rce/
third-party-advisory
-
apps.apple.com
/us/app/remote-for-mac/id1086962925
product
-
vulncheck.com
/advisories/remote-for-mac-rce
third-party-advisory
Sources
- CVE List CVE-2025-34089
- NVD CVE-2025-34089
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.