CVE-2025-11921

Summary

iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iStats: 7.10.4.

Affected Software

VendorProductVersion RangeStatus
BjangoiStats7.10.4affected

Weaknesses

  • CWE-732: CWE-732 Incorrect Permission Assignment for Critical Resource
  • CWE-77: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

References