Aquarius HelperTool 1.0.003 on macOS XPC Service backdoor

Summaryinfo

A vulnerability was found in Aquarius HelperTool 1.0.003 on macOS. It has been rated as critical. Impacted is an unknown function of the component XPC Service. The manipulation leads to backdoor. This vulnerability is traded as CVE-2025-65842. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Aquarius HelperTool 1.0.003 on macOS and classified as critical. This issue affects an unknown function of the component XPC Service. The manipulation with an unknown input leads to a backdoor vulnerability. Using CWE to declare the problem leads to CWE-912. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. The service accepts XPC connections from any local process without validating the client's identity, and its authorization logic incorrectly calls AuthorizationCopyRights with a NULL reference, causing all authorization checks to succeed. The executeCommand:authorization:withReply: method then interpolates attacker-controlled input into NSTask and executes it with root privileges. A local attacker can exploit these weaknesses to run arbitrary commands as root, create persistent backdoors, or obtain a fully interactive root shell.

The advisory is shared at almightysec.com. The identification of this vulnerability is CVE-2025-65842 since 11/18/2025. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1588.001 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Aquarius

Name

• HelperTool

Version

• 1.0.003

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion