CVE-2025-65841 describes a vulnerability in Aquarius Desktop 3.0.069 for macOS where user credentials are stored in the local file ~/Library/Application Support/Aquarius/aquarius.settings using a weak, predictable byte-substitution obfuscation. This method can be trivially reversed, enabling an attacker who can read this file to recover the plaintext password. With the stolen credentials, the attacker can import the configuration into their own client or log in via the vendor website, resulting in complete account takeover and unauthorized access to cloud-synchronized data and user actions.

The vulnerability allows complete account takeover without user interaction or privileges beyond file read access. This leads to unauthorized access to cloud-synchronized data and the ability to perform actions authenticated as the victim user. The confidentiality of the password is compromised, but the CVSS vector indicates no direct confidentiality or integrity impact beyond availability (denial of service) impact is rated high, which appears inconsistent with the description. The primary impact is unauthorized account access and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should restrict access to the local settings file to trusted users only. Avoid storing credentials in weakly obfuscated forms and consider using more secure credential storage mechanisms such as the macOS Keychain. Monitor vendor communications for updates and patches addressing this issue.