Description
AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted service path configuration to inject malicious executables that will be run with high-level system permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AnyDesk | AnyDesk | 7.0.15, 9.0.1 | — |
Advisories 1
- WID-SEC-2025-2829 AnyDesk: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode BSI CERT-Bund (WID) · Dec 11, 2025
References
- ExploitDB-52258 exploit
- ExploitDB-51968 exploit
- AnyDesk Homepage product
- AnyDesk Software Link product
- VulnCheck Advisory: AnyDesk 9.0.1 Unquoted Service Path Privilege Escalation Vulnerability third-party-advisory