Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-34499. PoCs published by Parastou Razi, Milad karimi.
AI-analyzed exploit summary This is a writeup describing an unquoted service path vulnerability in AnyDesk 9.0.1, which could allow local privilege escalation (LPE) due to the service path being unquoted and running with SYSTEM privileges. The provided output from `sc qc anydesk` confirms the vulnerable configuration.
Description
AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted service path configuration to inject malicious executables that will be run with high-level system permissions.
Exploits (2)
This is a writeup describing an unquoted service path vulnerability in AnyDesk 9.0.1, which could allow local privilege escalation (LPE) due to the service path being unquoted and running with SYSTEM privileges. The provided output from `sc qc anydesk` confirms the vulnerable configuration.
This is a writeup describing an unquoted service path vulnerability in AnyDesk 7.0.15, which could allow local privilege escalation (LPE) due to the service path not being enclosed in quotes. The provided output demonstrates the service configuration and OS details but does not include executable exploit code.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N