CVE-2025-61228
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in Shirt Pocket SuperDuper! version 3.10 and earlier allows a local attacker to execute arbitrary code via the software update mechanism.
Risk Assessment
A local attacker can take control of the system by installing malicious updates, compromising data confidentiality, integrity, and availability.
Recommendation
Immediately update to the latest version of SuperDuper! and restrict local system access to trusted users only.
Other vulnerabilities in SuperDuper!
See all- CVE-2025-69604High
A vulnerability in SuperDuper! 3.11 and earlier allows a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thereby bypassing macOS privacy controls.
- CVE-2025-61229High
A vulnerability in Shirt Pocket SuperDuper! 3.10 and earlier allows a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thereby bypassing macOS privacy controls.
Original NVD description (English source)
An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism