CVE-2025-2098
Last modified
CVE-2025-2098 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects Fast CAD Reader in possibly all versions since the vendor has not responded to our messages. The tested version was 4.1.5
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-2098?
How severe is CVE-2025-2098?
How do I fix CVE-2025-2098?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-20974Improper handling of insufficient permission in PackageInsta…6.1
- CVE-2025-20975Improper Export of Android Application Components in AODServ…5.5
- CVE-2025-20976Out-of-bounds read in applying binary of text content in Sam…7.5
- CVE-2025-20977Use of implicit intent for sensitive communication in transl…3.3
- CVE-2025-20978Improper access control in PENUP prior to version 3.9.19.32 …6.2
- CVE-2025-20979Out-of-bounds write in libsavscmn prior to Android 15 allows…7.8
- CVE-2025-20980Out-of-bounds write in libsavscmn prior to Android 15 allows…5.5
- CVE-2025-20981Improper access control in AudioService prior to SMR Jun-202…6.2
- CVE-2025-20982Out-of-bounds write in setting auth secret in KnoxVault trus…6.7
- CVE-2025-20983Out-of-bounds write in checking auth secret in KnoxVault tru…6.7
- CVE-2025-20984Incorrect default permission in Samsung Cloud for Galaxy Wat…6.2
- CVE-2025-20985Improper privilege management in ThemeManager prior to SMR J…3.3
Are you affected by CVE-2025-2098?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST