What is the CVSS score of CVE-2025-57489?

CVE-2025-57489 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Superduper are affected by CVE-2025-57489?

A high-severity privilege escalation vulnerability in Shirt Pocket SuperDuper! v3.10 allows attackers to gain root-level access to affected systems through an improperly secured binary component.

How to fix or mitigate CVE-2025-57489?

Within 24 hours: Identify all systems running SuperDuper! v3.10 and assess exposure in your environment; restrict user access to the application where possible. Within 7 days: Implement network segmentation to limit lateral movement from compromised systems and monitor for suspicious privilege escalation attempts. Within 30 days: Contact Shirt Pocket for patch availability and timeline; evaluate alternative backup solutions if patching timeline is unacceptable or migrate to patched versions immediately upon release.

Superduper CVE-2025-57489

EUVD-2025-200027 HIGH

Improper Access Control (CWE-284)

2025-12-01 cve@mitre.org

Authentication Bypass Superduper

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200027

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

CVE Published

Dec 01, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to the improper use of a setuid binary.

Analysis

Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to the improper use of a setuid binary.

Technical ContextAI

Privilege escalation allows a low-privileged user or process to gain elevated permissions beyond what was originally authorized. This vulnerability is classified as Improper Access Control (CWE-284).

RemediationAI

Apply the principle of least privilege. Keep systems patched. Monitor for suspicious privilege changes. Use mandatory access controls (SELinux, AppArmor).