CVE-2025-65841
📋 TL;DR
Aquarius Desktop 3.0.069 for macOS stores user credentials in a local file using weak obfuscation that can be easily reversed, allowing attackers who can read the file to fully compromise the victim's account. This leads to complete account takeover, unauthorized access to cloud-synchronized data, and authenticated actions as the user. All macOS users running this specific version are affected.
💻 Affected Systems
- Aquarius Desktop
📦 What is this software?
Aquarius by Acustica Audio
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover leading to unauthorized access to all cloud-synchronized data, ability to perform authenticated actions as the victim, and potential data theft or manipulation.
Likely Case
Local attackers or malware with file read access can steal credentials and compromise the Aquarius account, accessing synchronized data and performing actions as the user.
If Mitigated
With proper file permissions and endpoint security, only privileged users or malware with elevated access could exploit this vulnerability.
🎯 Exploit Status
Exploitation requires local file read access. The weak obfuscation scheme is trivial to reverse according to the description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check vendor websites (acustica.com, aquarius.com) for security updates. If no patch is available, consider discontinuing use until a fix is released.
🔧 Temporary Workarounds
Remove or secure settings file
macOSDelete or restrict permissions on the vulnerable settings file to prevent credential theft
rm ~/Library/Application\ Support/Aquarius/aquarius.settings
chmod 600 ~/Library/Application\ Support/Aquarius/aquarius.settings
Use application sandboxing
macOSRun Aquarius Desktop in a sandboxed environment to limit file access
🧯 If You Can't Patch
- Discontinue use of Aquarius Desktop 3.0.069 on macOS until a patched version is available
- Implement strict file permissions and monitor for unauthorized access to the settings file location
🔍 How to Verify
Check if Vulnerable:
Check if ~/Library/Application Support/Aquarius/aquarius.settings exists and contains obfuscated credentials. Examine the file for password-like data.Check Version:
Check Aquarius Desktop application version in About menu or application infoVerify Fix Applied:
Verify the settings file no longer contains obfuscated credentials or has been removed/restricted. Check for updated version from vendor.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to ~/Library/Application Support/Aquarius/ directory
- Unexpected authentication from new locations
Network Indicators:
- Unusual API calls or data synchronization patterns from user account
SIEM Query:
file_access:path="*/Library/Application Support/Aquarius/aquarius.settings" AND user!=authorized_user