CVE-2025-34499 in AnyDesk
Summary
by MITRE • 12/12/2025
AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted service path configuration to inject malicious executables that will be run with high-level system permissions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/12/2025
The vulnerability identified as CVE-2025-34499 affects AnyDesk versions 7.0.15 and 9.0.1, presenting a critical security flaw through an unquoted service path configuration that creates an exploitable condition for local privilege escalation. This vulnerability resides within the Windows service implementation of AnyDesk, where the service path is not properly quoted, creating an opportunity for malicious actors to place executable files in directories that are searched before the intended service location. The flaw allows local non-privileged users to potentially execute code with elevated SYSTEM privileges, representing a significant security risk that could be leveraged for persistent system compromise.
The technical implementation of this vulnerability stems from improper service path handling within the AnyDesk installation process. When Windows services are configured without properly quoted paths, the operating system searches through the directory structure in a predictable manner, potentially executing malicious binaries placed in parent directories. This behavior aligns with CWE-428, which describes the vulnerability of unquoted service paths, and represents a classic privilege escalation vector. The service configuration fails to properly sanitize the path string, allowing attackers to manipulate the execution flow by placing malicious executables in directories that Windows searches before the intended service location, potentially leading to arbitrary code execution with SYSTEM privileges.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it provides attackers with a persistent foothold within the compromised system. Once exploited, the malicious code executes with elevated privileges, enabling attackers to modify system files, install additional malware, or establish backdoors that persist across reboots. The vulnerability affects any local user with basic system access, making it particularly dangerous in multi-user environments or when system administrators fail to implement proper access controls. This flaw directly relates to ATT&CK technique T1068, which covers the exploitation of local privilege escalation vulnerabilities, and can be used to establish a foothold for further lateral movement within a network infrastructure.
Effective mitigation strategies for this vulnerability include immediate patching of AnyDesk installations to versions that properly quote service paths, as well as implementing proper service path validation during system hardening processes. System administrators should conduct thorough service path audits to identify similar vulnerabilities in other applications and ensure that all service paths are properly quoted to prevent exploitation. Additionally, implementing least privilege principles and monitoring for unauthorized executable placements in system directories can help detect potential exploitation attempts. The vulnerability demonstrates the critical importance of proper service configuration management and highlights the need for continuous security auditing of installed applications to prevent exploitation of similar unquoted path vulnerabilities that could be leveraged for system compromise.