CVE-2025-34499: 
AnyDesk vulnerability analysis and mitigation

CVE-2025-34499 is an unquoted service path vulnerability in AnyDesk versions 7.0.15 and 9.0.1 that allows local non-privileged users to execute arbitrary code with SYSTEM-level privileges. The vulnerability was published on December 11, 2025, and is classified under CWE-428 (Unquoted Search Path or Element). It carries a CVSS v4.0 base score of 6.9 (Medium), assigned by VulnCheck (VulnCheck Advisory, EUVD).

The root cause is an improperly quoted Windows service path in AnyDesk's installation (CWE-428). When a Windows service is registered with an unquoted executable path containing spaces, the Windows Service Control Manager may attempt to execute intermediate path segments as executables. A local attacker with write access to a parent directory in the unquoted path can place a malicious executable (e.g., AnyDesk.exe in C:\Program Files\) that Windows will execute with SYSTEM privileges when the AnyDesk service starts or restarts. Exploit code for this vulnerability is publicly available on Exploit-DB (Exploit-DB 52258, Exploit-DB 51968).

Successful exploitation allows a local attacker to escalate privileges from a standard user account to SYSTEM level, achieving full control over the affected Windows host. This enables the attacker to install malware, modify system configurations, access all data on the system, disable security controls, and potentially use the compromised host as a pivot point for lateral movement within the network. Confidentiality and integrity of the system are both compromised, though availability is not directly impacted by the vulnerability itself (VulnCheck Advisory, EUVD).

Public exploit code is available on Exploit-DB for this vulnerability (entries 52258 and 51968), lowering the barrier for exploitation (Exploit-DB 52258, Exploit-DB 51968). The EPSS score is approximately 0.056%, indicating a currently low probability of widespread exploitation. There is no confirmed evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the target system, which limits the attack surface compared to remote vulnerabilities.

1. Reconnaissance: Gain local (non-privileged) access to a Windows system running AnyDesk 7.0.15 or 9.0.1. Confirm the AnyDesk service is installed and its path is unquoted using sc qc AnyDesk or wmic service get name,pathname,startmode | findstr /i anydesk.
2. Identify vulnerable path: Determine the unquoted service executable path (e.g., C:\Program Files (x86)\AnyDesk\AnyDesk.exe) and identify which parent directories in the path are writable by the current user.
3. Craft malicious executable: Create a malicious executable (e.g., a reverse shell or privilege-escalating payload) and name it to match the first space-delimited segment of the path (e.g., Program.exe in C:\ or AnyDesk.exe in a writable intermediate directory).
4. Place the payload: Copy the malicious executable to the writable directory that Windows will search before the legitimate executable path.
5. Trigger service restart: Wait for or trigger a system reboot, or if permitted, restart the AnyDesk service (sc stop AnyDesk && sc start AnyDesk). Windows SCM will execute the malicious binary with SYSTEM privileges instead of the legitimate AnyDesk executable.
6. Achieve SYSTEM access: The payload executes as SYSTEM, granting full control of the host (Exploit-DB 52258, VulnCheck Advisory).

• Logs: Windows System Event Log entries showing AnyDesk service stopping and starting unexpectedly (Event ID 7036); unexpected service control events (Event IDs 7045, 7040) around the time of exploitation.
• File System: Presence of unexpected executables in directories along the AnyDesk service path (e.g., C:\Program.exe, C:\Program Files\AnyDesk.exe, or similar path-segment executables); newly created or modified files in AnyDesk installation parent directories.
• Process: Unusual processes spawned as SYSTEM that are children of services.exe but unrelated to legitimate AnyDesk activity; command shells (cmd.exe, powershell.exe) running under SYSTEM context originating from the AnyDesk service path.
• Network: Unexpected outbound network connections from a SYSTEM-level process on the AnyDesk host to external IPs, potentially indicating a reverse shell or C2 beacon.

Users should update AnyDesk to a version that corrects the unquoted service path. As an interim workaround, administrators can manually quote the AnyDesk service path in the Windows registry (HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk, ImagePath value) to enclose the executable path in double quotes. Additionally, restricting write permissions on directories in the AnyDesk installation path to non-privileged users reduces exploitation risk. Organizations should audit all installed services for unquoted paths using tools like sc qc or PowerShell (VulnCheck Advisory).