PT-2025-38405

CVE-2025-10672

Published

2025-09-18

Updated

2025-09-18

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AIBattery versions up to 1.0.9

Description A vulnerability exists in AIBattery that results in missing authentication. The issue is located in an unknown function within the AIBatteryHelper/XPC/BatteryXPCService.swift file of the com.collweb.AIBatteryHelper component. Exploitation requires local access. The exploit for this issue has been made public.

Recommendations AIBattery versions prior to 1.0.9 should be updated.

Exploitability

Exploit

Fix

Impacts

Researchers

Swayzgl1Tzyyy

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

CWE-306: Missing Authentication for Critical Function