CVE-2025-11921
Last modified
CVE-2025-11921 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iStats: 7.10.4.. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iStats: 7.10.4.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-11921?
How severe is CVE-2025-11921?
How do I fix CVE-2025-11921?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-11915Connection desynchronization between an HTTP proxy and the m…6.9
- CVE-2025-11917The WPeMatico RSS Feed Fetcher plugin for WordPress is vulne…6.4
- CVE-2025-11918Rockwell Automation Arena® suffers from a stack-based buffer…7.3
- CVE-2025-11919The default JVM can access files and directories under `/tmp…9.6
- CVE-2025-1192A vulnerability was found in SourceCodester Multi Restaurant…8.8
- CVE-2025-11920The WPCOM Member plugin for WordPress is vulnerable to Local…8.8
- CVE-2025-11922The Inactive Logout plugin for WordPress is vulnerable to St…6.4
- CVE-2025-11923The LifterLMS – WP LMS for eLearning, Online Courses, & Quiz…8.8
- CVE-2025-11924The Ninja Forms – The Contact Form Builder That Grows With Y…7.5
- CVE-2025-11925Incorrect Content-Type header in one of the APIs (`text/html…6.1
- CVE-2025-11926The Related Posts Lite plugin for WordPress is vulnerable to…4.4
- CVE-2025-11927The Flying Images: Optimize and Lazy Load Images for Faster …4.4
Are you affected by CVE-2025-11921?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST