What is the CVSS score of CVE-2025-69604?

CVE-2025-69604 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Superduper are affected by CVE-2025-69604?

CVE-2025-69604 affects Shirt Pocket's SuperDuper! backup software and allows local attackers to gain root-level access and bypass macOS security controls by modifying task templates.

How to fix or mitigate CVE-2025-69604?

Within 24 hours: Inventory all systems running SuperDuper! 3.11 and earlier; restrict local access to affected systems and limit user privileges. Within 7 days: Contact Shirt Pocket for patch availability and status; evaluate alternative backup solutions if patches remain unavailable. Within 30 days: Apply vendor patch immediately upon release; for unpatched systems, implement application whitelisting and disable SuperDuper! task scheduling until remediated.

Superduper CVE-2025-69604

HIGH

Incorrect Default Permissions (CWE-276)

2026-01-29 cve@mitre.org

Privilege Escalation Apple Superduper

7.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 29, 2026 - 20:16 nvd

HIGH 7.8

DescriptionCVE.org

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

AnalysisAI

Technical ContextAI

Classified as CWE-276 (Incorrect Default Permissions). Affects Superduper\!. An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.