CVE-2025-34089: CWE-306 Missing Authentication for Critical Function in Aexol Studio Remote for Mac
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allow unknown devices" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.
AI Analysis
Technical Summary
This vulnerability in Remote for Mac arises from missing authentication on a critical function, specifically the /api/executeScript endpoint. If authentication is disabled, attackers can remotely send AppleScript payloads via the X-Script HTTP header, which are executed using 'do shell script' on the macOS host. This leads to arbitrary command execution with the application's process privileges. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the affected macOS system with the privileges of the Remote for Mac background process. This can lead to full system compromise depending on those privileges. The vulnerability severely impacts confidentiality, integrity, and availability of the host system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should ensure that the "Allow unknown devices" option is disabled to enforce authentication and prevent unauthorized access to the /api/executeScript endpoint.
CVE-2025-34089: CWE-306 Missing Authentication for Critical Function in Aexol Studio Remote for Mac
Description
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allow unknown devices" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.
CVSS v4.0
Score 9.3critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Remote for Mac arises from missing authentication on a critical function, specifically the /api/executeScript endpoint. If authentication is disabled, attackers can remotely send AppleScript payloads via the X-Script HTTP header, which are executed using 'do shell script' on the macOS host. This leads to arbitrary command execution with the application's process privileges. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the affected macOS system with the privileges of the Remote for Mac background process. This can lead to full system compromise depending on those privileges. The vulnerability severely impacts confidentiality, integrity, and availability of the host system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should ensure that the "Allow unknown devices" option is disabled to enforce authentication and prevent unauthorized access to the /api/executeScript endpoint.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.551Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6866dff66f40f0eb729b625a
Added to database: 07/03/2025, 19:54:30 UTC
Last enriched: 05/21/2026, 12:06:08 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 281
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.