CVE-2019-25261
Anydesk 5.4.0
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2019-25261 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Anydesk Anydesk. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25261 is an unquoted service path vulnerability affecting AnyDesk version 5.4.0 on Windows systems. The issue resides in the software's Windows service configuration, where the service binary path lacks proper quoting, enabling local attackers to potentially inject malicious executables into locations that the service would execute.
Local attackers with low privileges (AV:L/AC:L/PR:L) can exploit this vulnerability by placing malicious files in directories parsed by the unquoted service path, such as intermediate folders along the path to the legitimate AnyDesk executable. Successful exploitation allows attackers to execute arbitrary code with elevated system privileges, resulting in high confidentiality, integrity, and availability impacts (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-428 (Unquoted Search Path or Element).
Advisories and references, including the AnyDesk vendor site (http://anydesk.com), an Exploit-DB proof-of-concept (https://www.exploit-db.com/exploits/47883), and a Vulncheck advisory (https://www.vulncheck.com/advisories/anydesk-unquoted-service-path), document the issue, with the Exploit-DB entry providing exploit details for reproduction.
A publicly available exploit on Exploit-DB indicates proof-of-concept exploitation is feasible, though no widespread real-world attacks are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19379
Vulnerability Data
AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially inject malicious executables. Attackers can exploit the unquoted binary path to place malicious files in service executable locations, potentially gaining elevated…
more
system privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables path interception via unquoted service binary path (T1574.009) for local privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws such as the unquoted service path vulnerability in AnyDesk 5.4.0.
Enforces secure and documented configuration settings for Windows services, including proper quoting of executable paths to block exploitation.
Deploys malicious code protection mechanisms to scan for and prevent execution of injected malicious executables via the unquoted service path.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unquoted search-path issues before deployment.
Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.
Secure system architecture and engineering principles require safe path construction and quoting conventions.
Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.
Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.