CVE-2025-14493 Overview
CVE-2025-14493 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service and stems from an exposed dangerous function [CWE-749]. A local attacker with the ability to run low-privileged code on the target system can leverage the exposed interface to execute arbitrary code in the context of SYSTEM. The issue was reported through the Zero Day Initiative as ZDI-CAN-27675 and tracked in advisory ZDI-25-1170.
Critical Impact
Successful exploitation grants full SYSTEM-level code execution on Windows hosts running vulnerable SUPERAntiSpyware Professional installations.
Affected Products
- RealDefense SUPERAntiSpyware Professional
- SUPERAntiSpyware SAS Core Service
- Windows endpoints running affected SUPERAntiSpyware builds
Discovery Timeline
- 2025-12-23 - CVE-2025-14493 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-14493
Vulnerability Analysis
The vulnerability affects the SAS Core Service component that ships with SUPERAntiSpyware. The service runs at SYSTEM privileges and exposes a function that performs privileged operations without adequate caller validation. A low-privileged local user can invoke that function through the service's interface and coerce it into executing attacker-controlled code or performing privileged file operations. Because the service already holds elevated tokens, any code path reached through the exposed function inherits SYSTEM context.
Root Cause
The defect is classified under [CWE-749]: Exposed Dangerous Method or Function. The SAS Core Service publishes a callable routine that should be restricted to trusted callers but does not enforce that boundary. The service treats requests from unprivileged local processes as trusted, allowing invocation of functionality intended for internal use only.
Attack Vector
Exploitation requires local access and the ability to execute low-privileged code, matching an AV:L/PR:L profile. The attacker connects to the SAS Core Service interface from a standard user session and issues a crafted request that triggers the exposed function. No user interaction is required. The resulting SYSTEM execution enables the attacker to install persistent implants, disable security controls, or pivot laterally.
No public proof-of-concept has been released. Technical specifics are documented in the Zero Day Initiative Advisory ZDI-25-1170.
Detection Methods for CVE-2025-14493
Indicators of Compromise
- Unexpected child processes spawned by the SAS Core Service executable running as NT AUTHORITY\SYSTEM.
- New services, scheduled tasks, or persistence entries created shortly after SUPERAntiSpyware service activity by a non-administrative user session.
- Modifications to files or registry keys in protected locations performed via the SUPERAntiSpyware service process.
Detection Strategies
- Monitor process creation events (Windows Event ID 4688 or Sysmon Event ID 1) where the parent process is the SAS Core Service and the child is cmd.exe, powershell.exe, or another interpreter.
- Alert on IPC or named-pipe connections to the SAS Core Service originating from processes owned by non-administrative users.
- Correlate low-integrity user activity with subsequent SYSTEM-context file writes or token manipulation events.
Monitoring Recommendations
- Baseline normal SAS Core Service behavior and flag deviations in child-process trees.
- Ingest endpoint telemetry into a centralized data lake to enable cross-host hunting for anomalous service invocations.
- Track installations of SUPERAntiSpyware across the estate and align patch status with vulnerability management data.
How to Mitigate CVE-2025-14493
Immediate Actions Required
- Inventory all endpoints running SUPERAntiSpyware Professional and identify vulnerable installations.
- Apply the vendor-supplied update referenced in ZDI-25-1170 as soon as it is available.
- Restrict local logon rights on high-value systems to reduce the pool of users who can invoke the vulnerable service.
Patch Information
Refer to the Zero Day Initiative Advisory ZDI-25-1170 and RealDefense/SUPERAntiSpyware vendor communications for the fixed build. Update all affected hosts to the patched version once released and confirm the SAS Core Service binary version reflects the fix.
Workarounds
- Where operationally feasible, stop and disable the SAS Core Service on systems that do not require SUPERAntiSpyware until a patched build is deployed.
- Enforce application allowlisting to prevent unauthorized low-privileged binaries from interacting with the vulnerable service interface.
- Remove SUPERAntiSpyware from systems where the product is no longer required.
# Example: query and disable the SAS Core Service on a Windows host
sc.exe query "SASCORE"
sc.exe stop "SASCORE"
sc.exe config "SASCORE" start= disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
