CVE-2025-27919
📋 TL;DR
This vulnerability in AnyDesk allows a remote user with 'Control my device' permission to modify settings and set a Full Access password without confirmation from the device owner. This enables unauthorized persistent access to the remote system. All AnyDesk users with remote control enabled are affected.
💻 Affected Systems
- AnyDesk
📦 What is this software?
Anydesk by Anydesk
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains persistent unauthorized access to remote systems, enabling data theft, ransomware deployment, or complete system compromise.
Likely Case
Unauthorized users maintain access to systems they previously had temporary permission to control, potentially accessing sensitive data or systems.
If Mitigated
With proper access controls and monitoring, impact is limited to temporary unauthorized access that can be detected and revoked.
🎯 Exploit Status
Exploitation requires initial legitimate access with control permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.5 or later
Vendor Advisory: https://anydesk.com/en/changelog/windows
Restart Required: Yes
Instructions:
1. Download AnyDesk 9.0.5 or later from official website. 2. Install over existing installation. 3. Restart AnyDesk service or reboot system.
🔧 Temporary Workarounds
Disable Full Access Password Feature
allPrevent setting of Full Access passwords in settings
Not applicable - GUI configuration only
Restrict 'Control my device' Permissions
allOnly grant temporary access to trusted users
Not applicable - policy configuration
🧯 If You Can't Patch
- Disable AnyDesk remote access entirely when not needed
- Implement network segmentation to isolate AnyDesk traffic
🔍 How to Verify
Check if Vulnerable:
Check AnyDesk version in Help > About. If version is 9.0.4 or earlier, system is vulnerable.Check Version:
anydesk --version (Linux) or check Help > About (Windows/macOS)Verify Fix Applied:
Verify version is 9.0.5 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected Full Access password changes
- Unauthorized connections from previously authorized users
Network Indicators:
- AnyDesk connections outside normal business hours
- Connections from unexpected geolocations
SIEM Query:
source="anydesk.log" AND (event="password_change" OR event="full_access_enabled")