RCE in Aexol Studio Remote For Mac
CVE-2025-34089
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allow unknown devices" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.014 (69.5th percentile) — read the EPSS interpretation.
Affected products
- Aexol Studio Remote For Mac — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34089?
- CVE-2025-34089 is a vulnerability in Aexol Studio Remote For Mac, classified under Code Injection. Published 2025-07-03.
- Is CVE-2025-34089 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.