CVE-2016-20094

HIGH

AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2016-20094 has a selected CVSS score of 8.5 (high); EIP currently links 1 catalogued exploit.

Description

AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root path that execute with elevated privileges during application startup or system reboot.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 22, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

AnyDesk

Browse Anydesk / AnyDesk
CVE List2.5.0affected

Proofs of concept

1

Catalogued exploits

ExploitDBAnyDesk 2.5.0 - Unquoted Service Path Privilege EscalationExploitDB exploitby TulpaNot analyzed1 file
ExploitDB
PoC details

References

5