CVE-2025-25364: Speedify VPN MacOS privilege Escalation
blog.securelayer7.net
SecureLayer7 discovered CVE-2025-25364, which is a crit­i­cal com­mand in­jec­tion vul­ner­a­bil­i­ty dis­cov­ered in the me.connectify.SMJobBlessHelper XPC ser­vice, a priv­i­leged helper tool used by Speed­i­fy VPN on ma­cOS. This ser­vice, which runs with el­e­vat­ed (root) priv­i­leges, is re­spon­si­ble for per­form­ing sys­tem-lev­el op­er­a­tions such as man­ag­ing net­work set­tings. Due to im­prop­er in­put val­i­da­tion of user-con­trolled fields (cmdPath and...