CVE-2025-34499 - CVE House
Back to Database
Status published Medium CVE-2025-34499

AnyDesk 9.0.1 Unquoted Service Path Privilege Escalation Vulnerability

Vulnerability Description

AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted service path configuration to inject malicious executables that will be run with high-level system permissions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34499

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Parastou Razi
  • Milad Karimi (Ex3ptionaL)

References

More from AnyDesk

View All →
CVE-2024-12754
AnyDesk Link Following Information Disclosure Vulnerability
Medium 5.5

Affected Vendor

Affected Software

AnyDesk
Vulnerable Versions:
7.0.15, 9.0.1

Timeline

Official Publish: December 11th, 2025
Last Modified: March 5th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-428

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow
Privilege Escalation
T1036 Masquerading
Defense Evasion
T1543 Create or Modify System Process
Persistence
T1059 Command and Scripting Interpreter
Execution
T1569 System Services
Execution