CVE-2025-14979
Privilege Escalation via Insecure XPC Service in AirVPN Eddie MacOS
Publication date: 2026-01-06
Last updated on: 2026-04-09
Assigner: Fluid Attacks
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| airvpn | eddie | 2.24.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in AirVPN Eddie on macOS involves an insecure XPC service that allows local, unprivileged users to escalate their privileges to root. Essentially, a user without administrative rights can exploit this flaw to gain full root access on the affected system, compromising its security.
How can this vulnerability impact me? :
The vulnerability can allow a local attacker to gain root privileges on a macOS system running the affected version of AirVPN Eddie (2.24.6). This means the attacker could execute arbitrary code with full system privileges, potentially leading to complete system compromise, unauthorized data access, or disruption of system operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect the vulnerability by checking for the presence of the privileged helper tool and the wrapper script at /usr/local/bin/eddie-cli with root ownership and permissions 0755. Specifically, verify if the 'Don't ask elevation every run' option is enabled, which installs the LaunchDaemon org.airvpn.eddie.ui.elevated.plist running the privileged helper persistently. Commands to check include: 1) Listing the wrapper script and checking permissions: `ls -l /usr/local/bin/eddie-cli` 2) Checking the LaunchDaemon presence: `launchctl list | grep org.airvpn.eddie.ui.elevated` or `ls /Library/LaunchDaemons/org.airvpn.eddie.ui.elevated.plist` 3) Inspecting the content of the wrapper script to see if it executes user-supplied executables without validation: `cat /usr/local/bin/eddie-cli` 4) Checking for files with the immutable flag set that could be abused: `ls -lO /usr/local/bin/eddie-cli` or `ls -lO /usr/local/bin` These checks help identify if the vulnerable components are present and potentially exploitable on your system. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Avoid enabling the 'Don't ask elevation every run' option in Eddie VPN settings, as this installs the vulnerable privileged helper service. 2) If this option is already enabled, disable it to stop the persistent privileged helper from running. 3) Remove or restrict access to the wrapper script at /usr/local/bin/eddie-cli to prevent exploitation. 4) Monitor and remove any malicious wrapper scripts or files with the immutable flag that could be abused. 5) Since no patch is currently available, users should exercise caution and avoid using the vulnerable version (2.24.6) on macOS until a fix is released. 6) Consider limiting local user access to the system to trusted users only to reduce risk. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.