Cyber Resilience

CVE-2019-25261

HighPublic PoC

Published: 03 February 2026

Published
03 February 2026
Modified
25 February 2026
KEV Added
Patch
CVSS Score v4 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0016 5.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25261 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Anydesk Anydesk. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 5.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25261 is an unquoted service path vulnerability affecting AnyDesk version 5.4.0 on Windows systems. The issue resides in the software's Windows service configuration, where the service binary path lacks proper quoting, enabling local attackers to potentially inject malicious executables into locations that the service would execute.

Local attackers with low privileges (AV:L/AC:L/PR:L) can exploit this vulnerability by placing malicious files in directories parsed by the unquoted service path, such as intermediate folders along the path to the legitimate AnyDesk executable. Successful exploitation allows attackers to execute arbitrary code with elevated system privileges, resulting in high confidentiality, integrity, and availability impacts (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-428 (Unquoted Search Path or Element).

Advisories and references, including the AnyDesk vendor site (http://anydesk.com), an Exploit-DB proof-of-concept (https://www.exploit-db.com/exploits/47883), and a Vulncheck advisory (https://www.vulncheck.com/advisories/anydesk-unquoted-service-path), document the issue, with the Exploit-DB entry providing exploit details for reproduction.

A publicly available exploit on Exploit-DB indicates proof-of-concept exploitation is feasible, though no widespread real-world attacks are detailed in the provided information.

EU & UK References

Vulnerability details

AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially inject malicious executables. Attackers can exploit the unquoted binary path to place malicious files in service executable locations, potentially gaining elevated…

more

system privileges.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1574.009 Path Interception by Unquoted Path Stealth
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Directly enables path interception via unquoted service binary path (T1574.009) for local privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-27918Same product: Anydesk Anydesk
CVE-2022-50914Shared CWE-428
CVE-2020-36982Shared CWE-428
CVE-2020-36987Shared CWE-428
CVE-2021-47825Shared CWE-428
CVE-2020-37059Shared CWE-428
CVE-2020-36953Shared CWE-428
CVE-2022-50935Shared CWE-428
CVE-2021-47864Shared CWE-428
CVE-2020-37060Shared CWE-428

Affected Assets

anydesk
anydesk
5.4.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires timely identification, reporting, and correction of flaws such as the unquoted service path vulnerability in AnyDesk 5.4.0.

prevent

Enforces secure and documented configuration settings for Windows services, including proper quoting of executable paths to block exploitation.

preventdetect

Deploys malicious code protection mechanisms to scan for and prevent execution of injected malicious executables via the unquoted service path.

References