CVE-2016-20094: 
AnyDesk vulnerability analysis and mitigation

CVE-2016-20094 is an unquoted service path vulnerability (Elevation of Privilege) in AnyDesk version 2.5.0 for Windows. It allows local users with low privileges to execute arbitrary code with SYSTEM-level privileges by placing a malicious executable in a path that Windows resolves before the intended AnyDesk service binary during application startup or system reboot. The CVE was formally published on June 19, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, VulnCheck Advisory).

The root cause is CWE-428 (Unquoted Search Path or Element): when Windows resolves a service binary path containing spaces without enclosing quotes, it attempts to execute each space-delimited path segment as a potential executable before reaching the intended binary. In AnyDesk 2.5.0, the service installation registers an unquoted path, allowing an attacker with write access to a parent directory (e.g., C:\Program.exe or C:\Program Files\AnyDesk.exe) to place a malicious executable that Windows will execute as SYSTEM when the service starts. Exploitation requires only low-privilege local access and no user interaction. A proof-of-concept exploit is publicly available on Exploit-DB (Exploit-DB PoC, VulnCheck Advisory).

Successful exploitation grants the attacker full SYSTEM-level code execution on the affected Windows host, resulting in high confidentiality, integrity, and availability impact. An attacker can read or exfiltrate sensitive data, modify system files, install persistent backdoors, disable security controls, or use the compromised system as a pivot point for lateral movement within the network. The impact is confined to the vulnerable system itself (no subsequent system impact in the CVSS v4.0 model), but SYSTEM privileges effectively represent total control of the host (GitHub Advisory, VulnCheck Advisory).

A public proof-of-concept exploit is available on Exploit-DB (EDB-40410), and CISA's SSVC assessment classifies exploitation status as "poc" with technical impact rated "total" (Exploit-DB PoC). There is no current evidence of active in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.12–0.18%, indicating a low near-term exploitation probability (GitHub Advisory). Exploitation is not automatable as it requires local access to the target system.

1. Reconnaissance: Identify systems running AnyDesk 2.5.0 on Windows. Confirm the vulnerable service path by running sc qc AnyDesk or querying the registry at HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk to verify the ImagePath value is unquoted and contains spaces.
2. Identify exploitable path segment: Parse the unquoted service path (e.g., C:\Program Files\AnyDesk\AnyDesk.exe) to determine which parent directory segments are writable by a low-privileged user (e.g., C:\Program.exe or C:\Program Files\AnyDesk.exe depending on permissions).
3. Craft malicious executable: Compile or obtain a malicious payload (e.g., a reverse shell, privilege-escalating binary, or persistence mechanism) and name it to match the exploitable path segment (e.g., Program.exe).
4. Place the malicious executable: Copy the malicious binary to the writable parent path location (e.g., C:\Program.exe) using the low-privileged account's write access.
5. Trigger execution: Wait for the AnyDesk service to restart (e.g., via system reboot or service restart), at which point Windows resolves the unquoted path and executes the malicious binary with SYSTEM privileges before reaching the legitimate AnyDesk binary (Exploit-DB PoC, VulnCheck Advisory).

• File System: Unexpected executables in system root or intermediate path directories matching unquoted service path segments (e.g., C:\Program.exe, C:\Program Files\AnyDesk.exe placed by a non-administrator account); new or modified files in AnyDesk installation directories.
• Logs: Windows Event Log entries (Event ID 7045 or 7036) showing AnyDesk service start/stop events followed by unexpected process creation; Security Event Log entries (Event ID 4688) showing processes spawned by services.exe with unusual parent-child relationships.
• Process: Unexpected processes (e.g., cmd.exe, powershell.exe, reverse shell binaries) running under the SYSTEM account with services.exe as the parent process around the time of AnyDesk service startup.
• Registry: Verification of HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk\ImagePath showing an unquoted path value containing spaces.

Upgrade AnyDesk to a version newer than 2.5.0, which resolves the unquoted service path issue. As an immediate workaround, restrict write permissions on system root and intermediate directories (e.g., C:\, C:\Program Files\) to prevent low-privileged users from placing executables in exploitable locations. Administrators can also manually correct the service path by quoting it in the registry (HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk\ImagePath) as a temporary measure until patching is feasible (VulnCheck Advisory, GitHub Advisory).