[CVE-2016-20094] AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arb…

Descripción técnica

AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root path that execute with elevated privileges during application startup or system reboot.

Puntuación CVSS

Score: 7.8/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Anydesk — Anydesk

Debilidades (CWE)

CWE-428

Fuente oficial

Publicado en NIST NVD.