CVE-2025-9815
alaneuler batteryKid NSXPCListener PrivilegeHelper.swift missing authentication
- State
- Published
- Severity
- 8.5 High
- Published
- Sep 2, 2025
- Updated
- Sep 2, 2025
- Reserved
- Sep 1, 2025
Description
A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHelper.swift of the component NSXPCListener. This manipulation causes missing authentication. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.8 High | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.8 Medium | AV:L/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
batteryKidalaneuler |
|
References
- VDB-322142 | alaneuler batteryKid NSXPCListener PrivilegeHelper.swift missing authenticationvdb-entry
- VDB-322142 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #641358 | alaneuler batteryKid v2.1 Missing Authentication for Critical Functionthird-party-advisory
- https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.mdrelated
- https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-conceptsexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.