Read the docs
TI-2025-24253 Aliases CVE-2025-34089GHSA-5pfw-6387-hgmr

Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection

Priority HIGH 81CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-94.

Summary

An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allow unknown devices" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02348 83rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Aexol StudioRemote for Macup to 2025.7—No fix listedCNA
  • Remote for Mac VendorAexol Studio Affected up to 2025.7 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34089
  2. 2026-10-03 Alias added: GHSA-5pfw-6387-hgmr

References

Exploit 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences