Full Disclosure mailing list archives

Hello Full Disclosure list,

Cipher Security Labs has published technical details for three
High-severity vulnerabilities affecting HP Easy Start for macOS. The
issues were coordinated with HP and are addressed in HP Easy Start
2.16.7.260722 and later under HPSBPI04124.

Research title:
Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries

Affected product:
HP Easy Start for macOS

Affected versions:
Versions prior to 2.16.7.260722

Validated vulnerable sample:
2.16.0 (build 251010)

Fixed:
2.16.7.260722 and later

CVE-2026-12554
CVSS 4.0: 8.5 High
CWE-1104: Use of Unmaintained Third-Party Components

The affected software-download path contained an OSPFTP stack wired
into component acquisition, including fallback URL-scheme handling.
The research does not claim that every installation uses FTP on the
normal path; the finding is that an unmaintained FTP-capable component
remained active on the privileged software-delivery surface.

CVE-2026-12555
CVSS 4.0: 7.7 High
CWE-379: Creation of Temporary File in Directory with Insecure Permissions

The HP Uninstaller used predictable paths under /tmp and /private/tmp
while operating with administrative privileges. An unprivileged local
user could prepare a symbolic link before the elevated process opened
the path. In our PoC, after the user approved the normal macOS
administrative prompt, HP-generated log data was appended through the
symlink to an attacker-selected proof file as root.

We intentionally describe this as privileged file
modification/corruption rather than unrestricted arbitrary file write:
destination control is demonstrated, but the log content itself is
generated by HP Easy Start. Follow-on privilege escalation would
require a suitable environment-specific target and is not automatic.

CVE-2026-12556
CVSS 4.0: 7.7 High
CWE-319: Cleartext Transmission of Sensitive Information

HP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App
Transport Security policy and retained cleartext FTP as a
software-download fallback. Together these conditions expanded the
circumstances in which a network-positioned attacker could interfere
with software-component acquisition when the primary scheme failed.

The research does not claim that NSAllowsArbitraryLoads alone disables
certificate validation, that every install falls back to FTP, or that
package substitution automatically yields code execution. Those are
separate conditions and are treated separately in the analysis.

Related design note — not a fourth CVE

The 2.16.0 build also contained SWHelper, a privileged helper using
Apple’s deprecated AuthorizationExecuteWithPrivileges API. The legacy
API and path-oriented privileged install flow were confirmed, but an
end-to-end package-swap TOCTOU against the production staging path was
not demonstrated. This is therefore documented only as a risky
privilege-boundary design with conditional exploitability.

Remediation validation

In 2.16.7 (build 260722), Cipher Security Labs validated that:

• the vulnerable Uninstaller bundle was removed from the package tested;
• OSPFTP download classes and FTP software-download markers were absent;
• blanket ATS relaxation was tightened;
• SWHelper and AuthorizationExecuteWithPrivileges were removed;
• a new privileged helper used SMAppService and NSXPCConnection;
• the helper restricted clients by code-signing identity; and
• package SHA-256 was verified using an already-open file descriptor
before invoking /usr/sbin/installer.

Research:
https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries

HP advisory:
https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124

CVE records:
https://www.cve.org/CVERecord?id=CVE-2026-12554
https://www.cve.org/CVERecord?id=CVE-2026-12555
https://www.cve.org/CVERecord?id=CVE-2026-12556

Researcher:
Nir Yehoshua
Cipher Security Labs
nir () ciphersecuritylabs com
https://ciphersecuritylabs.com

Regards,
Nir
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556 Nir Yehoshua (Sep 03)