Vulnerability · Published Mar 26, 2025 · Assigned by CERT-PL

CVE-2025-2098Dylib Hijacking in Fast CAD Reader

High 8.4

In plain English

A high-severity incorrect permission assignment in Fast CAD Reader from Beijing Honghu Yuntu Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.2%top 93.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects Fast CAD Reader in possibly all versions since the vendor has not responded to our messages. The tested version was 4.1.5

Affected products (as reported)

Vendor	Product	Versions
Beijing Honghu Yuntu Technology	Fast CAD Reader	0 – through 4.1.5

Weakness: CWE-732 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

References

https://cert.pl/en/posts/2025/03/CVE-2025-2098/ third-party-advisory
https://apps.apple.com/pl/app/fast-cad-reader/id1484905765 product