WiFiman Desktop CVE-2026-119250

Requires that WiFiman Desktop for macOS is installed on the host and that the attacker already has an interactive low-privileged local account (per CVSS PR:L, AV:L). The specific External Control of File Name or Path flaw (CWE-73) lets the low-privileged user control a file name or path that the application's privileged component acts on, resulting in command execution as root; the precise feature or path that is attacker-controllable is not detailed in the available sources. Limiting factors: no remote exploitation is possible (local access mandatory), the target must have the macOS client installed, and the attacker needs a pre-existing foothold with at least low privileges; no user interaction is required once those conditions are met.

This is a credible local privilege-escalation issue rather than a high-CVSS paper risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local attacker who already holds a low-privileged account on the macOS host and needs no user interaction to abuse External Control of File Name or Path (CWE-73) and run arbitrary commands as root - a full host compromise (C:H/I:H/A:H). The 7.8 base score is consistent with that mechanism. However, the attack vector is strictly local: there is no remote entry point, so the practical risk depends on an attacker first gaining a foothold on a machine that has WiFiman Desktop installed. EPSS is not provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no proof-of-concept or exploit reference is present, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency remediation priority that aligns with a locally-exploitable root escalation in a non-ubiquitous desktop app. One data caveat: the input tags include 'Information Disclosure', which conflicts with the description's actual impact (arbitrary root command execution / privilege escalation) - treat the tag, not the CVSS/description, as the less reliable signal.

A local user with an unprivileged account on a macOS machine running WiFiman Desktop influences a file name or path the application handles, causing it to execute an attacker-controlled command through its privileged (root) component. The attacker thereby escalates from a low-privileged shell to root on the host. No public exploit or PoC is referenced in the available sources, and exploitation requires prior local access with low privileges.