HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556
Nir Yehoshua ·
Hello Full Disclosure list, Cipher Security Labs has published technical details for three High-severity vulnerabilities affecting HP Easy Start for macOS. The issues were coordinated with HP and are addressed in HP Easy Start 2.16.7.260722 and later under HPSBPI04124. Research title: Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries Affected product: HP Easy Start for macOS Affected versions: Versions prior to 2.16.7.260722 Validated vulnerable sample: 2.16.0 (build 251010) Fixed: 2.16.7.260722 and later CVE-2026-12554 CVSS 4.0: 8.5 High CWE-1104: Use of Unmaintained Third-Party Components The affected software-download path contained an OSPFTP stack wired into component acquisition, including fallback URL-scheme handling. The research does not claim that every installation uses FTP on the normal path; the finding is that an unmaintained FTP-capable component remained active on the privileged software-delivery surface. CVE-2026-12555 CVSS 4.0: 7.7 High CWE-379: Creation of Temporary File in Directory with Insecure Permissions The HP Uninstaller used predictable paths under /tmp and /private/tmp while operating with administrative privileges. An unprivileged local user could prepare a symbolic link before the elevated process opened the path. In our PoC, after the user approved the normal macOS administrative prompt, HP-generated log data was appended through the symlink to an attacker-selected proof file as root. We intentionally describe this as privileged file modification/corruption rather than unrestricted arbitrary file write: destination control is demonstrated, but the log content itself is generated by HP Easy Start. Follow-on privilege escalation would require a suitable environment-specific target and is not automatic. CVE-2026-12556 CVSS 4.0: 7.7 High CWE-319: Cleartext Transmission of Sensitive Information HP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App Transport Security policy and retained cleartext FTP as a software-download fallback. Together these conditions expanded the circumstances in which a network-positioned attacker could interfere with software-component acquisition when the primary scheme failed. The research does not claim that NSAllowsArbitraryLoads alone disables certificate validation, that every install falls back to FTP, or that package substitution automatically yields code execution. Those are separate conditions and are treated separately in the analysis. Related design note — not a fourth CVE The 2.16.0 build also contained SWHelper, a privileged helper using Apple’s deprecated AuthorizationExecuteWithPrivileges API. The legacy API and path-oriented privileged install flow were confirmed, but an end-to-end package-swap TOCTOU against the production staging path was not demonstrated. This is therefore documented only as a risky privilege-boundary design with conditional exploitability. Remediation validation In 2.16.7 (build 260722), Cipher Security Labs validated that: • the vulnerable Uninstaller bundle was removed from the package tested; • OSPFTP download classes and FTP software-download markers were absent; • blanket ATS relaxation was tightened; • SWHelper and AuthorizationExecuteWithPrivileges were removed; • a new privileged helper used SMAppService and NSXPCConnection; • the helper restricted clients by code-signing identity; and • package SHA-256 was verified using an already-open file descriptor before invoking /usr/sbin/installer. Research: https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries HP advisory: https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124 CVE records: https://www.cve.org/CVERecord?id=CVE-2026-12554 https://www.cve.org/CVERecord?id=CVE-2026-12555 https://www.cve.org/CVERecord?id=CVE-2026-12556 Researcher: Nir Yehoshua Cipher Security Labs nir () ciphersecuritylabs com https://ciphersecuritylabs.com Regards, Nir _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/