CVE-2025-12843
📋 TL;DR
This CVE describes a code injection vulnerability in waveterm's Electron Fuses implementation on macOS that allows bypassing TCC (Transparency, Consent, and Control) protections. Attackers can execute arbitrary code with elevated permissions, potentially accessing sensitive system resources. Users running waveterm 0.12.2 on macOS are affected.
💻 Affected Systems
- waveterm
📦 What is this software?
Wave Terminal by Waveterm
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to access sensitive data (camera, microphone, files), install persistent malware, or pivot to other systems on the network.
Likely Case
Local privilege escalation leading to unauthorized access to protected resources like camera, microphone, or sensitive files that normally require user consent.
If Mitigated
Limited impact if proper application sandboxing and TCC protections are enforced, though some system resources may still be accessible.
🎯 Exploit Status
Exploitation requires local access or user interaction. The advisory from Fluid Attacks provides technical details about the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check waveterm GitHub repository for latest version
Vendor Advisory: https://github.com/wavetermdev/waveterm
Restart Required: Yes
Instructions:
1. Visit waveterm GitHub repository 2. Download latest version 3. Uninstall old version 4. Install new version 5. Restart system
🔧 Temporary Workarounds
Disable or Remove waveterm
macOSUninstall waveterm to eliminate the vulnerability
sudo rm -rf /Applications/waveterm.app
brew uninstall waveterm
Restrict Application Permissions
macOSUse macOS Privacy settings to restrict waveterm's access to sensitive resources
🧯 If You Can't Patch
- Implement strict application control policies to prevent unauthorized waveterm execution
- Monitor for suspicious process creation or TCC permission changes related to waveterm
🔍 How to Verify
Check if Vulnerable:
Check waveterm version: Open waveterm → About menu or check installed version in Applications folderCheck Version:
defaults read /Applications/waveterm.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Verify installed version is newer than 0.12.2 and check GitHub for security updates📡 Detection & Monitoring
Log Indicators:
- Unexpected TCC permission grants to waveterm
- Suspicious child processes spawned from waveterm
Network Indicators:
- Unusual outbound connections from waveterm process
SIEM Query:
process_name:"waveterm" AND (event_type:"process_creation" OR event_type:"tcc_permission_change")