CVEvulnerability

CVE-2025-3651

9.3 CRITICAL Published 2025-04-17 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-04-17
Last modified
2026-06-17
Assigner
5d978718-751a-428d-ac8e-4f9445ebfd11
CVSS 4.0 (5d978718-751a-428d-ac8e-4f9445ebfd11)
9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-346, CWE-668

Description

Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to execute arbitrary commands via unauthorized access to the Agent service.  This has been remediated in Work Desktop for Mac version 10.8.2.33.

Related

Weakness · CWE (2)

  • CWE-346 Origin Validation Error weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

Referenced by CWE · observed example (1)

  • CWE-940 Improper Verification of Source of a Communication Channel weakness

References