Parallels Desktop 19.4.1 54985 Data Reporter link following

Summaryinfo

A vulnerability classified as critical has been found in Parallels Desktop 19.4.1 54985. This impacts an unknown function of the component Data Reporter. Performing a manipulation results in link following. This vulnerability is cataloged as CVE-2025-0413. The attack must be initiated from a local position. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Parallels Desktop 19.4.1 54985. This affects some unknown processing of the component Data Reporter. The manipulation with an unknown input leads to a link following vulnerability. CWE is classifying the issue as CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Technical Data Reporter component. By creating a symbolic link, an attacker can abuse the service to change the permissions of arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-25014.

It is possible to read the advisory at zerodayinitiative.com. This vulnerability is uniquely identified as CVE-2025-0413 since 01/13/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 20.2.055872 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Parallels

Name

• Desktop

Version

• 19.4.1 54985

License

• commercial

Website

• Vendor: https://www.parallels.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion