Information Disclosure Vulnerability in AnyDesk
CVE-2024-12754
Key Information:
- Vendor
- Anydesk
- Status
- Anydesk
- Vendor
- CVE Published:
- 30 December 2024
Badges
What is CVE-2024-12754?
CVE-2024-12754 is a vulnerability identified in AnyDesk, a remote desktop software used for remote access and online collaboration. This information disclosure vulnerability enables local attackers to access sensitive information within affected installations of AnyDesk. If exploited, it may result in unauthorized access to stored credentials, which could lead to further security breaches and data compromise within an organization.
Technical Details
The vulnerability stems from improper handling of background images in AnyDesk. An attacker, having gained the ability to execute low-privileged code on the target machine, can create a junction that allows the misuse of the service for reading arbitrary files. This flaw is linked to the mechanisms responsible for managing background images, creating a pathway for unauthorized information retrieval.
Potential impact of CVE-2024-12754
-
Unauthorized Information Disclosure: This vulnerability can facilitate the disclosure of sensitive information, including user credentials, putting the organization at risk of unauthorized access to critical systems.
-
Increased Risk of Further Compromise: With disclosed credentials, attackers can potentially gain higher privileges or access additional sensitive data, exacerbating the impact on organizational security.
-
Reputational Damage: In the event of a breach resulting from this vulnerability, organizations may experience significant reputational harm, leading to a loss of customer trust and potential financial implications.
Affected Version(s)
AnyDesk 8.0.9.0
Get notified when SecurityVulnerability.io launches alerting 🔔
Well keep you posted 📧
News Articles
PoC Exploit Released for AnyDesk Vulnerability Exploited to Gain Admin Access Via Wallpapers
According to cybersecurity researcher Naor Hodorov, the flaw lies in how AnyDesk processes desktop background images during session initialization.
2 days ago
Hackers Exploit AnyDesk Vulnerability to Gain Admin Access – PoC Released
A newly discovered vulnerability in AnyDesk, the popular remote desktop software, has sparked serious cybersecurity concerns.
2 days ago
Weaponizing Windows Background Images to Gain Admin Access Using AnyDesk Vulnerability
A recently disclosed vulnerability in AnyDesk, a widely used remote desktop software, has raised significant cybersecurity concerns.
6 days ago