CVE-2025-9815
📋 TL;DR
This vulnerability allows local attackers to bypass authentication in the batteryKid application's privilege helper component on macOS. Attackers can exploit missing authentication in the NSXPCListener to execute unauthorized actions. Only macOS users running batteryKid version 2.1 or earlier are affected.
💻 Affected Systems
- alaneuler batteryKid
📦 What is this software?
Batterykid by Alaneuler
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation allowing attackers to execute arbitrary code with elevated privileges, potentially gaining full system control.
Likely Case
Unauthorized access to privileged functions within the batteryKid application, potentially modifying system battery settings or configurations.
If Mitigated
Limited impact if proper application sandboxing and privilege separation are implemented.
🎯 Exploit Status
Proof-of-concept exploit is publicly available in GitHub repositories. Exploitation requires local access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Check for updates from the batteryKid developer
2. If no patch is available, uninstall batteryKid
3. Monitor vendor channels for security updates
🔧 Temporary Workarounds
Uninstall batteryKid
macOSRemove the vulnerable application from the system
sudo rm -rf /Applications/batteryKid.app
sudo rm -rf ~/Library/Application\ Support/batteryKid
Disable PrivilegeHelper
macOSRemove or disable the vulnerable helper component
sudo rm -f /Library/PrivilegedHelperTools/com.alaneuler.batteryKid.PrivilegeHelper
sudo launchctl unload /Library/LaunchDaemons/com.alaneuler.batteryKid.PrivilegeHelper.plist
🧯 If You Can't Patch
- Implement strict local access controls and user privilege management
- Monitor for suspicious local process execution and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if batteryKid version 2.1 or earlier is installed: ls -la /Applications/ | grep batteryKidCheck Version:
Check application version in Info.plist: plutil -p /Applications/batteryKid.app/Contents/Info.plist | grep CFBundleShortVersionStringVerify Fix Applied:
Verify batteryKid is not installed or is updated to a version above 2.1📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to PrivilegeHelper
- Unexpected NSXPC connections to batteryKid components
- Privilege escalation attempts from batteryKid processes
Network Indicators:
- Local inter-process communication (IPC) to batteryKid helper services
SIEM Query:
process_name:"PrivilegeHelper" AND parent_process_name:"batteryKid" AND event_type:"privilege_escalation"🔗 References
- https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md
- https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-concepts
- https://vuldb.com/?ctiid.322142
- https://vuldb.com/?id.322142
- https://vuldb.com/?submit.641358
- https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md
- https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-concepts
