CVE-2016-20094

AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege

CVSS 8.5 HIGHEPSS 0.1%CWE-428

AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root path that execute with elevated privileges during application startup or system reboot.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Anydesk · AnyDesk

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/40410unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://anydesk.com http://anydesk.com/download https://www.exploit-db.com/exploits/40410 https://www.vulncheck.com/advisories/anydesk-unquoted-service-path-elevation-of-privilege