CVE-2024-12754

Deeper analysis

CVE-2024-12754 is a link-following information disclosure vulnerability in AnyDesk. The flaw resides in the application's handling of background images, where improper resolution of junctions allows a local process to redirect file reads performed by the AnyDesk service. Successful exploitation grants read access to arbitrary files on the system, including stored credentials.

An attacker who already possesses the ability to run low-privileged code on the target host can create a junction pointing to a sensitive file and trigger the background-image processing path. This action causes the AnyDesk service to disclose the file contents, enabling the attacker to obtain credentials that may facilitate further privilege escalation or lateral movement. The vulnerability carries a CVSS v3 score of 5.5 and is tracked as ZDI-CAN-23940.

The single published reference points to the Zero Day Initiative advisory ZDI-24-1711, which describes the issue but supplies no additional mitigation details in the available data. The associated EPSS scores remain low, with a current value of 0.0449 and a peak of 0.0500, indicating no significant post-disclosure rise in observed exploitation activity.