SUPERAntiSpyware
CVE-2025-14497
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged code execution on host
-
ExploitInvoke exposed dangerous function in SAS Core Service
-
ExecutionExecute arbitrary code as SYSTEM
-
ImpactFull host compromise / persistence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already possess the ability to run low-privileged code on a system where SUPERAntiSpyware Professional is installed and its SAS Core Service is running - this is the primary limiting factor and the reason the vector is local (AV:L), not remote. The flaw stems from an exposed dangerous function (CWE-749) reachable by low-privileged users against what appears to be the default installation; no special non-default configuration is called out in the advisory. No user interaction is required (UI:N), and only low privileges are needed (PR:L). The practical ceiling on exploitation is the need for prior local access and the product actually being installed, which is uncommon in enterprise fleets. |
| Impact | This is a credible but context-limited priority. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N) confirms local access with low privileges and no user interaction, yielding a solid 7.8 HIGH with full CIA impact (C:H/I:H/A:H) because the flaw escalates to SYSTEM. However, several high-signal indicators are MISSING from the input: no EPSS score, no CISA KEV listing, and no POC indicator were provided, so exploitation probability cannot be quantified. The only source is a single Zero Day Initiative advisory (ZDI-25-1168, formerly ZDI-CAN-27680), reported by Trend Micro ZDI - a reputable source, but ZDI advisories typically coordinate disclosure without releasing public exploit code. Because this is a local privilege-escalation issue (not remotely reachable), real-world risk is gated by an attacker first achieving low-privileged code execution on the host; it is a post-compromise escalation primitive rather than an initial-access vulnerability. Net: a legitimately dangerous LPE on a security product, but absent EPSS/KEV/POC data the urgency is moderate - patch in normal cycles unless the product is known to be deployed on sensitive endpoints. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged foothold on a Windows system (e.g., via phishing or a standard user account) invokes an exposed dangerous function in the SUPERAntiSpyware SAS Core Service. The service performs the requested operation in a privileged context, allowing the attacker to execute arbitrary code as SYSTEM and fully compromise the host. No public exploit identified at time of analysis, though CVSS AC:L indicates the escalation is low-complexity once local access is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escalate to SYSTEM by invoking an exposed dangerous function in the SAS Core Service. Exploitation requires the attacker to already be able to execute code on the host and the SAS Core Service to be running, which limits the attack surface to local, post-compromise scenarios. With a CVSS score of 7.8 and no CISA KEV listing or public exploit identified at time of analysis, this is a credible but context-limited priority.
RemediationAI
Vendor patch status is not confirmed in the provided data; consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-1168/ and RealDefense for an updated SUPERAntiSpyware Professional build. In the absence of a confirmed fix, reduce exposure by preventing low-privileged users from executing arbitrary code on hosts running the SAS Core Service: enforce application allowlisting, remove unnecessary interactive logon and local execution rights, and deploy EDR monitoring for SYSTEM-level child processes or anomalous IPC/RPC activity involving the SAS Core Service. If the service is not operationally required, disabling it will remove the attack surface but may break real-time protection and other product features. These are compensating controls only and do not remediate the underlying CWE-749 exposure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-749 (Exposed Dangerous Function or Method) in the SAS Core Service, a component that runs with SYSTEM privileges. Low-privileged local users can reach a function or interface that should be restricted and abuse it to run arbitrary code at SYSTEM integrity. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the local attack vector, low privileges required, and no user interaction; the CPE string points specifically to the Professional edition of SUPERAntiSpyware. No special configuration is identified in the advisory data, so default installations with the service running appear to be in scope. The root cause is the service exposing a dangerous function to a lower-privileged caller rather than enforcing strict access controls on that interface.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires existing low-privileged local code execution (AV:L, PR:L), is straightforward once present (AC:L), needs no interaction (UI:N), and yields full SYSTEM compromise (C/I/A:H).
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27680.
Executive ViewAI
RealDefense SUPERAntiSpyware Professional has a high-severity local privilege-escalation issue that could let an attacker with an existing endpoint foothold gain SYSTEM-level control, increasing the blast radius of a local compromise. Risk is concentrated on hosts where the product is installed and the SAS Core Service is running, especially where low-privileged code execution is already possible. No vendor-released patch was identified at time of analysis and no public exploit was identified at time of analysis, so leadership should prioritize scoping, hardening, and vendor coordination rather than emergency enterprise-wide action.
No vendor-released patch identified at time of analysis; enforce least privilege, application allowlisting, restrict local code execution, monitor SAS Core Service activity, consider disabling or removing the product on high-risk hosts, and obtain interim guidance from RealDefense.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
GitHub PoC
Exploit-DB