CVE-2019-25261: 
AnyDesk vulnerability analysis and mitigation

CVE-2019-25261 is an unquoted service path vulnerability (CWE-428) in AnyDesk 5.4.0 for Windows that allows local attackers with low privileges to inject malicious executables and potentially gain elevated system privileges. The vulnerability was originally discovered in 2019 and formally published in the CVE database on February 3, 2026, assigned by VulnCheck. Only AnyDesk version 5.4.0 on Windows is confirmed affected. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (Feedly, Exploit-DB).

The root cause is CWE-428 (Unquoted Search Path or Element): AnyDesk's Windows service is configured with an unquoted binary path. When Windows resolves an unquoted service executable path containing spaces, it attempts to execute files at each space-delimited path segment before reaching the intended binary. A local attacker with write access to a parent directory in the service path can place a malicious executable at an earlier path resolution point (e.g., C:\Program.exe if the path is C:\Program Files\AnyDesk\AnyDesk.exe), which Windows will execute with SYSTEM privileges when the service starts or restarts. Exploitation requires local access and low-level privileges but no user interaction (Exploit-DB, VulnCheck).

Successful exploitation allows a low-privileged local attacker to execute arbitrary code in the context of the Windows SYSTEM account, resulting in full system compromise. This yields high impact to confidentiality (access to all data on the system), integrity (ability to modify any files or configurations), and availability (ability to disrupt or destroy services). On systems where AnyDesk is used for remote administration, compromise could also facilitate lateral movement to connected endpoints (Feedly).

A proof-of-concept exploit is publicly available on Exploit-DB (EDB-47883), lowering the barrier for exploitation. However, there is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (0.000130), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Exploit-DB, Feedly).

1. Reconnaissance: Identify target Windows systems running AnyDesk 5.4.0 as a service. Use sc qc AnyDesk or wmic service get name,pathname,startmode to enumerate service configurations and confirm the unquoted path.
2. Identify writable directories: Determine the unquoted service path (e.g., C:\Program Files\AnyDesk\AnyDesk.exe) and check write permissions on parent directories (e.g., C:\Program Files\) using icacls.
3. Craft malicious executable: Prepare a malicious executable (e.g., a reverse shell or privilege escalation payload) named to match the first space-delimited path segment (e.g., Program.exe placed at C:\Program.exe).
4. Place the payload: Copy the malicious executable to the writable location in the service path where Windows will resolve it before the legitimate binary.
5. Trigger service restart: Wait for or trigger a service restart (e.g., system reboot, manual service restart if permitted) so Windows executes the malicious binary with SYSTEM privileges, granting full system access (Exploit-DB, VulnCheck).

• Logs: Windows System Event Log entries (Event ID 7036 or 7045) showing unexpected service state changes or new service installations; Security Event Log entries (Event ID 4688) showing unusual process creation from services.exe or svchost.exe.
• File System: Unexpected executables placed in root or intermediate directories of the AnyDesk service path (e.g., C:\Program.exe, C:\Program Files\AnyDesk.exe); newly created or modified files in directories along the service binary path.
• Process: Unusual child processes spawned by services.exe with SYSTEM privileges not matching the expected AnyDesk binary path; reverse shell or command-and-control processes running as SYSTEM.
• Registry: Changes to the ImagePath value under HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk that differ from the expected installation path (Exploit-DB).

Organizations should upgrade AnyDesk to a version newer than 5.4.0, as later releases are expected to correct the service path quoting issue. As an immediate workaround, administrators can manually correct the service binary path by quoting it using sc config AnyDesk binPath= "\"C:\Program Files\AnyDesk\AnyDesk.exe\"". Additionally, enforce strict access controls (ACLs) on directories in the service path to prevent low-privileged users from writing executables. Monitor service configurations regularly using tools like wmic service get name,pathname,startmode | findstr /i /v "c:\\windows\\" to detect unquoted paths across the environment (VulnCheck, Feedly).