CVE-2019-25261

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2019-25261 is an unquoted service path vulnerability affecting AnyDesk version 5.4.0 on Windows systems. The issue resides in the software's Windows service configuration, where the service binary path lacks proper quoting, enabling local attackers to potentially inject malicious executables into locations that the service would execute.

Local attackers with low privileges (AV:L/AC:L/PR:L) can exploit this vulnerability by placing malicious files in directories parsed by the unquoted service path, such as intermediate folders along the path to the legitimate AnyDesk executable. Successful exploitation allows attackers to execute arbitrary code with elevated system privileges, resulting in high confidentiality, integrity, and availability impacts (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-428 (Unquoted Search Path or Element).

Advisories and references, including the AnyDesk vendor site (http://anydesk.com), an Exploit-DB proof-of-concept (https://www.exploit-db.com/exploits/47883), and a Vulncheck advisory (https://www.vulncheck.com/advisories/anydesk-unquoted-service-path), document the issue, with the Exploit-DB entry providing exploit details for reproduction.

A publicly available exploit on Exploit-DB indicates proof-of-concept exploitation is feasible, though no widespread real-world attacks are detailed in the provided information.