What is the CVSS score of EUVD-2025-200025?

EUVD-2025-200025 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Superduper are affected by EUVD-2025-200025?

CVE-2025-61229 affects SuperDuper! 3.10 and earlier, allowing local attackers to execute arbitrary code with root privileges and Full Disk Access on macOS systems.

How to fix or mitigate EUVD-2025-200025?

Within 24 hours: Identify all systems running SuperDuper! 3.10 or earlier and assess their exposure to local users. Within 7 days: Restrict SuperDuper! access to trusted administrators only, disable automatic task execution, and review task template configurations for unauthorized modifications. Within 30 days: Monitor vendor communications for patch availability and establish a timeline for immediate deployment upon release.

Superduper EUVD-2025-200025

| CVE-2025-61229 HIGH

Incorrect Default Permissions (CWE-276)

2025-12-01 cve@mitre.org

Privilege Escalation Apple Superduper

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200025

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

CVE Published

Dec 01, 2025 - 16:15 nvd

HIGH 7.8

DescriptionNVD

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

Analysis

Technical ContextAI

Privilege escalation allows a low-privileged user or process to gain elevated permissions beyond what was originally authorized. This vulnerability is classified as Incorrect Default Permissions (CWE-276).

RemediationAI

Apply the principle of least privilege. Keep systems patched. Monitor for suspicious privilege changes. Use mandatory access controls (SELinux, AppArmor).