Unquoted Service Path Vulnerability in AnyDesk by AnyDesk GmbH
CVE-2016-20094

8.5HIGH

Key Information:

Vendor

Anydesk
Status
Anydesk
Vendor
CVE Published:
19 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20094?

AnyDesk version 2.5.0 is affected by an unquoted service path vulnerability, allowing local users to execute arbitrary code with SYSTEM privileges. By exploiting this flaw, attackers can place malicious executables into the system root path, enabling them to run with elevated privileges whenever the application starts or the system reboots. This presents a significant risk, as privileged access can lead to further exploitation of the system.

Affected Version(s)

AnyDesk 2.5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20094 - Proof of Concept

References

https://www.exploit-db.com/exploits/40410
exploit
http://anydesk.com
product
http://anydesk.com/download
product

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tulpa
.