CVE-2025-34499CWE-428

CVE-2025-34499

published December 12, 2025

CVSS
6.9
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted service path configuration to inject malicious executables that will be run with high-level system permissions.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2025-12-12T03:15Z
References (5)
http://anydesk.com · [email protected]http://anydesk.com/download · [email protected]https://www.exploit-db.com/exploits/51968 · [email protected]https://www.exploit-db.com/exploits/52258 · [email protected]https://www.vulncheck.com/advisories/anydesk-unquoted-service-path-privilege-escalation-vulnerability · [email protected]
EPSS history
Timeline
  • 11 DEC 21:43Z
    AnyDesk 9.0.1 Unquoted Service Path Privilege Escalation Vulnerability
    cvelistv5