AnyDesk CVE-2019-25261

Requires the attacker to already have local, interactive or code-execution access on the Windows host as a low-privileged user, plus write permission to a directory earlier in the AnyDesk service's unquoted executable path (e.g. the root of a path segment containing spaces such as C:\Program Files). Exploitation is NOT remote and NOT unauthenticated (PR:L): it depends on the service being installed with the unquoted path and on a service restart or system reboot occurring to launch the planted binary as SYSTEM. There is no user-interaction requirement from a victim. Limiting factors: default installation ACLs that deny non-admin write access to the relevant directories neutralize the flaw, so real-world exploitability hinges on loose filesystem permissions.

This is a classic local privilege-escalation issue (CWE-428, unquoted Windows service path) in AnyDesk 5.4.0, and the signals are internally consistent: the input CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H) correctly frames it as locally-exploitable, low-complexity, requiring an already-authenticated low-privileged user, with high impact to confidentiality, integrity and availability but no scope change to other systems. Publicly available exploit code exists (Exploit-DB 47883), yet the EPSS score is extremely low at 0.01% (3rd percentile), and the CVE is NOT in CISA KEV - so despite the headline 8.5 score and a public POC, there is no evidence of widespread or active exploitation. The low EPSS is expected for a local-only EoP: it cannot be mass-scanned or remotely wormed, so probability-of-exploitation models rate it low even though it is genuinely useful to an attacker who already has a foothold. Net: this is a real but second-stage priority (post-compromise LPE / persistence building block), not an internet-facing emergency. The local AV and PR:L requirement are the dominant risk-limiting factors. No signals conflict; the main caveat is that successful exploitation additionally depends on filesystem write permissions to a directory in the unquoted path, which the CVSS vector alone does not capture.

A low-privileged user (or malware already running in that context) on a Windows host with AnyDesk 5.4.0 installed identifies the service's unquoted binary path and plants a malicious executable at an earlier, attacker-writable path segment (e.g. C:\Program.exe). On the next service start or system reboot, the Service Control Manager launches the planted binary under the service account, escalating to SYSTEM. Public exploit/demonstration code for this class of flaw against AnyDesk is available (Exploit-DB 47883).