CVE-2016-20094: AnyDesk 2.5.0 Unquoted Service Path Privilege Escalation

Technical summary

CVE-2016-20094 exploits an unquoted service path vulnerability (CWE-428) in AnyDesk's Windows service installation. When a service path lacks quotation marks and contains spaces, Windows searches for and executes the first matching executable it finds in the path hierarchy. An attacker with local user privileges can craft a malicious executable—for example, named to match a partial path component—and place it in a predictable location within the system root. Upon service startup or system reboot, the Windows Service Control Manager will execute the attacker's payload with SYSTEM privileges. This is a post-authentication but pre-privilege-escalation scenario: the attacker needs initial local access but can then gain full system control.

Business impact

Compromise of AnyDesk 2.5.0 on affected systems opens a direct path to complete system takeover. An attacker gaining local user access—through phishing, weak credentials, or another vulnerability—can immediately escalate to SYSTEM privileges and maintain persistence across reboots. This affects confidentiality, integrity, and availability: data exfiltration, malware installation, lateral movement to other systems, and denial of service all become possible. Organizations relying on AnyDesk for remote support face heightened risk if vulnerable versions remain deployed on sensitive infrastructure.

Affected systems

AnyDesk version 2.5.0 on Windows systems is explicitly affected. Organizations should inventory AnyDesk deployments and identify which versions are running. Version 2.5.0 is relatively old; most users may have already upgraded. However, legacy systems, disconnected environments, or test/backup machines may still run vulnerable versions. Any Windows system with AnyDesk 2.5.0 installed and accessible to local users is at risk.

Exploitability

Exploitation requires local user access—not trivial, but not rare in real environments. An attacker cannot exploit this remotely without first compromising a local account or leveraging another vulnerability. Once local access is obtained, exploitation is straightforward and does not require user interaction or special tools. An attacker needs only to create a malicious executable with an appropriate name and place it in a system directory where the unquoted service path will find it first. The attack succeeds reliably upon service restart or system reboot. This is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of the attack vector means it could be weaponized quickly if widely publicized.

Remediation

The primary remediation is to upgrade AnyDesk to a patched version that properly quotes the service path. Verify the specific patched version number in the official AnyDesk advisory before deployment. As a compensating control pending upgrade, restrict local user account creation, enforce strong access controls on sensitive systems, and monitor for suspicious process execution under the SYSTEM account. Disable AnyDesk on systems where it is no longer required.

Patch guidance

Check the official AnyDesk security advisory and release notes for the first version after 2.5.0 that addresses this vulnerability. Typical patch deployment should prioritize systems where AnyDesk is exposed to untrusted local users or where data sensitivity is high. Test patches in a non-production environment first. After patching, verify that the service path in the registry (typically HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk) is properly quoted. Reboot affected systems to confirm the service starts correctly with the patched binary.

Detection guidance

Monitor for unexpected executables in system root directories (C:\, C:\Windows\, etc.) with names that could match partial path components of the AnyDesk service path. Use file integrity monitoring (FIM) on system directories to alert on new executable creation. Monitor service startup and process execution logs for AnyDesk launching unexpected child processes or from unexpected locations. Check the Windows Event Log (System and Security channels) for service startup anomalies. Endpoint Detection and Response (EDR) tools should flag execution from system root with SYSTEM privileges outside normal AnyDesk operations.

Why prioritize this

This vulnerability merits immediate investigation and remediation in affected environments. Although the CVSS score is 7.8 (HIGH), the true risk is amplified by the certainty and ease of exploitation once local access is obtained. The privilege escalation from local user to SYSTEM is severe in its consequences. Organizations with AnyDesk 2.5.0 deployed should prioritize patching, particularly on systems with multiple local user accounts, shared access, or exposure to less-trusted personnel. The age of the vulnerable version suggests many organizations may have already moved past it, but legacy and air-gapped systems warrant immediate attention.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity rating based on local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). This scoring correctly captures the practical danger: an unprivileged local user can deterministically achieve SYSTEM-level code execution. The lack of special attack complexity and low barrier to entry make this a credible threat in environments where local user segregation is weak.

Frequently asked questions