HP Easy Start for macOS: CVE-2026-12554/55/56 vulnerability advisory

Summary of Key Information for HP Easy Start for macOS Vulnerabilities Vulnerability Overview Product: HP Easy Start for macOS (com.hp.hp-easy-start) Affected Version: 2.16.0 (build 251858) Fixed Version: 2.16.7 (build 260722) and later CVE List: - CVE-2026-12554: Unauthenticated GSPFTP download stack (CWE-1184, CVSS 8.5) - CVE-2026-12555: Predictable world-writable temporary file paths (CWE-379, CVSS 7.7) - CVE-2026-12556: Plaintext software package download transmission via relaxed ATS and FTP fallback mechanism (CWE-319, CVSS 7.7) Impact Scope Attacker Model: - Local unprivileged user: Can create filenames under and , but cannot impersonate an admin password; can prepare the filesystem to wait for privileged file writes after privilege escalation. - Network-based attacker: Sharing a LAN segment or controlling the lab's DNS can interfere with software package retrieval via plaintext FTP. Main Impacts: - Creation/corruption of privileged files as root (creates the file if the target path does not exist; corrupts it if it already exists) - Corruption of service configurations or system files can lead to service interruptions - Privilege escalation can be triggered when appropriate second-stage targets exist prior to escalation - Expands the surface for plaintext substitution, increasing maintenance and supply chain risks - Network attackers can interfere with software component downloads Fix Strategies CVE-2026-12554: - Remove the unauthenticated GSPFTP stack from the software package download path - Use HTTPS exclusively for retrieval and enforce certificate validation - Perform integrity checks (hash/signature) on downloaded bytes before writing packages to privileged installer paths CVE-2026-12555: - Use securely generated temporary files (e.g., , ) or platform-native secure temporary APIs, avoiding static names - Use and (with where appropriate) when opening files, rather than a direct - Verify file existence prior to opening - Use restrictive permissions (e.g., 0600) to avoid placing privileged logs in shared world-writable directories - Re-evaluate whether logging must be executed under root CVE-2026-12556: - Retain only when absolutely necessary; remove FTP from package retrieval - Make certificate validation mandatory rather than an optional configuration Related Design Observations (Non-Public CVEs) Deprecated Authorization API: HP Easy Start 2.16.0 contains the deprecated API, which allows executing arbitrary tools as root, instead of using Apple’s modern Helper model. Confirmed: Static analysis confirmed references to and shared executable path strings in the binary. Unconfirmed: The end-to-end production path has not been proven, so no CVE has been assigned. POC / Exploit Code The page does not include a complete POC or exploit code block, only the following code snippets: > Note: The page primarily describes vulnerability mechanisms and fix recommendations; no complete executable POC code is provided.

Goal Reached Thanks to every supporter — we hit 100%!

HP Easy Start for macOS: CVE-2026-12554/55/56 vulnerability advisory