CVE-2025-0413
📋 TL;DR
This vulnerability in Parallels Desktop's Technical Data Reporter component allows local attackers to escalate privileges by creating symbolic links to manipulate file permissions. Attackers with initial low-privileged access can exploit this to gain root privileges and execute arbitrary code. Only Parallels Desktop installations with the vulnerable component are affected.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
Parallels by Parallels
Parallels by Parallels
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level code execution, allowing complete control over the host system, data theft, and persistence mechanisms.
Likely Case
Local privilege escalation from a standard user to root, enabling installation of malware, credential harvesting, and lateral movement within the environment.
If Mitigated
Limited impact if proper access controls prevent initial low-privileged code execution and file permission manipulation is monitored.
🎯 Exploit Status
Requires local access and ability to create symbolic links. Technical Data Reporter service must be running.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Parallels Desktop updates for latest version
Vendor Advisory: https://kb.parallels.com/130212
Restart Required: No
Instructions:
1. Open Parallels Desktop. 2. Go to Parallels Desktop menu > Check for Updates. 3. Install all available updates. 4. Verify update completion in About Parallels Desktop.
🔧 Temporary Workarounds
Disable Technical Data Reporter
macOSTemporarily disable the vulnerable component if patching isn't immediately possible
sudo launchctl unload /Library/LaunchDaemons/com.parallels.vm.prl_deskctl_rep.plist
🧯 If You Can't Patch
- Restrict local user privileges to prevent symbolic link creation in sensitive directories
- Implement application whitelisting to block unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check if Technical Data Reporter service is running: ps aux | grep prl_deskctl_repCheck Version:
Open Parallels Desktop > About Parallels Desktop, or check /Applications/Parallels\ Desktop.app/Contents/Info.plistVerify Fix Applied:
Verify service is updated or disabled, and check Parallels Desktop version matches patched release📡 Detection & Monitoring
Log Indicators:
- Unauthorized symbolic link creation in system directories
- Unexpected privilege escalation events
- Technical Data Reporter service anomalies
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
process_name:"prl_deskctl_rep" AND (event_type:"privilege_escalation" OR file_path:"*symlink*")