CVE-2025-9474
BaseFortify
Publication date: 2025-08-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mihomo | party | 1.8.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-378 | Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack. |
| CWE-377 | Creating and using insecure temporary files can leave application and system data vulnerable to attack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Mihomo Party for macOS allows a local attacker to exploit an insecurely permissioned UNIX socket created by the application. The socket is world-readable and writable and accepts unauthenticated HTTP requests. This enables any local user to connect to the socket and modify system-wide proxy settings, potentially redirecting network traffic through a malicious server. [1]
How can this vulnerability impact me? :
Exploiting this vulnerability can allow an attacker to redirect all system network traffic through a malicious server they control. This can lead to man-in-the-middle (MiTM) attacks, enabling interception, manipulation, or exfiltration of sensitive data transmitted over the network. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking for the presence of the UNIX socket `/tmp/mihomo-party-helper.sock` and inspecting its permissions. Use the command `ls -l /tmp/mihomo-party-helper.sock` to see if the socket exists and if it has world-readable and writable permissions. Additionally, monitoring for unauthorized changes to system-wide proxy settings or unusual network traffic redirection may indicate exploitation. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing or restricting access to the insecure UNIX socket `/tmp/mihomo-party-helper.sock` by changing its permissions to limit access only to trusted users. Updating Mihomo Party to a version later than 1.8.1 where this vulnerability is fixed is recommended. Additionally, monitor and restrict local user access to prevent unauthorized modification of system proxy settings. [1]