CVE-2025-27916
📋 TL;DR
This vulnerability allows attackers to spoof AnyDesk IDs when connections are established via IP addresses, enabling impersonation of legitimate remote access sessions. It affects AnyDesk for Windows versions before 9.0.6 and AnyDesk for Android versions before 8.0.0. Users who connect via IP addresses instead of AnyDesk IDs are vulnerable.
💻 Affected Systems
- AnyDesk for Windows
- AnyDesk for Android
📦 What is this software?
Anydesk by Anydesk
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept and manipulate remote desktop sessions, gaining unauthorized access to systems, stealing credentials, or deploying malware while appearing as legitimate connections.
Likely Case
Session hijacking where attackers impersonate legitimate users to access remote systems, potentially leading to data theft or unauthorized control.
If Mitigated
Limited impact if connections use AnyDesk IDs exclusively and proper authentication controls are in place.
🎯 Exploit Status
Requires network position to intercept and manipulate traffic between AnyDesk clients.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Windows: 9.0.6, Android: 8.0.0
Vendor Advisory: https://anydesk.com/en/changelog/windows
Restart Required: Yes
Instructions:
1. Download latest version from official AnyDesk website. 2. Install update. 3. Restart AnyDesk service or system.
🔧 Temporary Workarounds
Disable IP-based connections
allConfigure AnyDesk to only accept connections using AnyDesk IDs instead of IP addresses.
Network segmentation
allIsolate AnyDesk traffic to trusted networks only.
🧯 If You Can't Patch
- Use VPN for all remote connections to encrypt traffic and prevent spoofing.
- Implement strict access controls and monitor for unusual AnyDesk connection patterns.
🔍 How to Verify
Check if Vulnerable:
Check AnyDesk version: Windows - Help > About, Android - Settings > About. If version is below Windows 9.0.6 or Android 8.0.0, system is vulnerable.Check Version:
Windows: anydesk.exe --version, Android: Check in app settingsVerify Fix Applied:
Confirm version is Windows 9.0.6 or higher, or Android 8.0.0 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual connection patterns
- Multiple failed authentication attempts from same IP
- Connections from unexpected IP addresses
Network Indicators:
- Unencrypted AnyDesk traffic on untrusted networks
- Suspicious man-in-the-middle activity on AnyDesk ports (TCP 7070)
SIEM Query:
source="anydesk.log" AND (event="connection_failed" OR event="authentication_failure")