CVE-2022-32450 – This vulnerability in AnyDesk 7.0.9 allows a lo... (How to Fix)

Q: What is the severity of CVE-2022-32450?

CVE-2022-32450 has a CVSS score of 7.1 (HIGH). This vulnerability in AnyDesk 7.0.9 allows a local user to escalate privileges to SYSTEM via a symbolic link attack. The software writes chat-room data to the user's %APPDATA% folder with SYSTEM privileges, enabling arbitrary file writes. Only local authenticated users on Windows systems with AnyDesk installed are affected.

📋 TL;DR

This vulnerability in AnyDesk 7.0.9 allows a local user to escalate privileges to SYSTEM via a symbolic link attack. The software writes chat-room data to the user's %APPDATA% folder with SYSTEM privileges, enabling arbitrary file writes. Only local authenticated users on Windows systems with AnyDesk installed are affected.

💻 Affected Systems

Products:

AnyDesk

Versions: 7.0.9

Operating Systems: Windows

Default Config Vulnerable: ⚠️ Yes

Notes: Requires local user write access to their own %APPDATA% folder, which is standard in Windows.

📦 What is this software?

Anydesk by Anydesk

View all CVEs affecting Anydesk →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attacker gains full SYSTEM privileges, enabling complete system compromise, persistence installation, credential theft, and lateral movement.

🟠

Likely Case

Local user escalates to SYSTEM privileges to install malware, modify system files, or bypass security controls.

🟢

If Mitigated

Attack fails due to proper file permissions or security software blocking symbolic link creation.

🌐 Internet-Facing: LOW - This is a local privilege escalation requiring authenticated local access.

🏢 Internal Only: HIGH - Any local user on a system with vulnerable AnyDesk can potentially gain SYSTEM privileges.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires local authenticated access and knowledge of symbolic link creation. Public proof-of-concept available in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 7.0.10 or later

Vendor Advisory: http://anydesk.com

Restart Required: Yes

Instructions:

1. Download latest AnyDesk version from official website. 2. Uninstall current version. 3. Install updated version. 4. Restart system.

🔧 Temporary Workarounds

Restrict %APPDATA% write permissions

windows

Remove write permissions from user's %APPDATA% folder for AnyDesk-related files

icacls "%APPDATA%\AnyDesk" /deny %USERNAME%:(OI)(CI)F
icacls "%APPDATA%\AnyDesk" /deny %USERNAME%:(OI)(CI)W

Disable AnyDesk service

windows

Temporarily disable AnyDesk service to prevent exploitation

sc stop AnyDesk
sc config AnyDesk start= disabled

🧯 If You Can't Patch

Uninstall AnyDesk completely from affected systems
Implement strict file system monitoring for symbolic link creation in %APPDATA% folders

🔍 How to Verify

Check if Vulnerable:

Check AnyDesk version in Help > About. If version is 7.0.9, system is vulnerable.

Check Version:

wmic product where name="AnyDesk" get version

Verify Fix Applied:

Verify AnyDesk version is 7.0.10 or later in Help > About menu.

📡 Detection & Monitoring

Log Indicators:

Windows Event Logs showing file creation in %APPDATA%\AnyDesk with SYSTEM privileges
Unexpected symbolic link creation in user profiles

Network Indicators:

None - this is local exploitation only

SIEM Query:

EventID=4663 AND ObjectName LIKE "%APPDATA%\\AnyDesk%" AND SubjectUserName="SYSTEM"

📊 Metadata

CVE ID: CVE-2022-32450

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE: CWE-59

Published: July 18, 2022

Last Updated: November 21, 2024

🔗 References

http://anydesk.com Vendor Advisory
http://packetstormsecurity.com/files/167608/AnyDesk-7.0.9-Arbitrary-File-Write-Denial-Of-Service.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2022/Jul/9 Exploit,Mailing List,Third Party Advisory
https://seclists.org/fulldisclosure/2022/Jun/44 Exploit,Mailing List,Third Party Advisory
http://anydesk.com Vendor Advisory
http://packetstormsecurity.com/files/167608/AnyDesk-7.0.9-Arbitrary-File-Write-Denial-Of-Service.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2022/Jul/9 Exploit,Mailing List,Third Party Advisory
https://seclists.org/fulldisclosure/2022/Jun/44 Exploit,Mailing List,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-32450, you might also want to check these: