CVE-2025-30074
Published: 16 March 2025
Summary
CVE-2025-30074 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Parallels Desktop (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-30074 is a privilege escalation vulnerability affecting Alludo Parallels Desktop versions before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms. The flaw, tied to CWE-863 (Incorrect Authorization), occurs in the VM creation routine and enables escalation to root privileges. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and was published on 2025-03-16.
A local attacker with low privileges on the host macOS system can exploit this vulnerability. Exploitation requires high attack complexity but no user interaction. Success grants high-impact access to confidentiality, integrity, and availability, with a changed scope, allowing the attacker to achieve full root privileges on the Intel-based macOS host.
The Parallels knowledge base advisory at https://kb.parallels.com/en/130944 addresses mitigation by recommending updates to Parallels Desktop 19.4.2 or 20.2.2, which resolve the VM creation routine issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6653
Vulnerability details
Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local privilege escalation vulnerability (CWE-863) in Parallels Desktop VM creation routine, directly enabling T1068 Exploitation for Privilege Escalation to gain root on the macOS host.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly countering the CWE-863 incorrect authorization flaw in the Parallels VM creation routine that enables root privilege escalation.
Employs the principle of least privilege to restrict low-privilege local attackers from escalating to root via the vulnerable VM creation process.
Mandates timely identification, reporting, and correction of system flaws, enabling patching to Parallels Desktop 19.4.2 or 20.2.2 as specified in the vendor advisory.