AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows a local user to run arbitrary code with SYSTEM privileges. By placing malicious executables in the system root directory, a local attacker can have those files executed during AnyDesk startup or during a system reboot, effectively gaining full control of the affected machine.

Anydesk AnyDesk version 2.5.0 is affected. No other versions are listed as vulnerable in the available data.

The CVSS score of 8.5 indicates a high severity issue. The vulnerability is exploitable by any local user who has write access to the system root directory, a condition that is common on systems with administrative accounts. No EPSS score is available, but the absence of a KEV listing does not reduce the seriousness of the local privilege escalation potential.