CVE-2016-20094

Executive Summary

CVE-2016-20094 is an unquoted service path privilege escalation vulnerability affecting AnyDesk version 2.5.0. A local, unprivileged attacker can exploit this flaw to execute arbitrary code with SYSTEM privileges by placing a malicious executable in a directory referenced by the unquoted service path. The vulnerability remains unpatched across all tracked sources, and no public exploit code or proof-of-concept has been identified.

The attack requires local access to the target system, but the impact is total system compromise. AnyDesk is widely deployed in enterprise environments for remote support and administration, making this a high-risk finding for organizations relying on legacy versions of the software. The CVSS score of 8.5 reflects the high confidentiality, integrity, and availability impact achievable with low attack complexity and no user interaction required beyond local access.

Technical Analysis

The vulnerability stems from an improperly configured Windows service installation in AnyDesk 2.5.0. The service executable path is stored without surrounding quotation marks. When Windows attempts to launch the service, the operating system's service control manager interprets the path by splitting it at whitespace boundaries. If the path contains spaces, Windows will sequentially attempt to execute each token as a potential executable path.

For example, if the service is installed with a path such as C:\Program Files\AnyDesk\AnyDesk.exe (unquoted), the system will first attempt to execute C:\Program.exe, then C:\Program Files\AnyDesk.exe, and finally C:\Program Files\AnyDesk\AnyDesk.exe. An attacker with write access to any directory earlier in the path hierarchy can drop a malicious executable named to match one of the intermediate tokens (e.g., C:\Program.exe or a file named AnyDesk.exe inside the parent directory). When the service starts — either during system boot, login, or application startup — the crafted executable executes with SYSTEM privileges because the service runs under the LocalSystem account.

The flaw class is CWE-428 (Unquoted Search Path or Element), a well-documented Windows-specific configuration weakness. The attack surface is limited to local systems where AnyDesk 2.5.0 is installed with its default service configuration. The vulnerability does not require network access or authentication beyond a low-privileged local account.

Insufficient technical detail is available regarding the exact service name, binary installation path, or executable filename as these were not disclosed in the NVD description or CNA title. The attack mechanism, however, follows the standard unquoted service path exploitation pattern described above.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification
An attacker with local access to a target system identifies whether AnyDesk 2.5.0 is installed. This can be accomplished by enumerating running services (sc query or wmic service commands), inspecting the HKLM\System\CurrentControlSet\Services registry keys, or checking installed applications through the Control Panel or registry uninstall keys. The presence of AnyDesk version 2.5.0 confirms the vulnerable configuration.

Step 2: Triggering the Flaw
Once the unquoted service path is confirmed, the attacker checks for write permissions in directories that appear earlier in the path hierarchy. Any directory that permits creation of files by unprivileged users becomes a viable planting location. The attacker creates a malicious executable with a filename that matches the intermediate path token (e.g., AnyDesk.exe placed in the parent directory of the intended executable).

Step 3: Payload and Execution
The payload is a binary compiled to run with elevated privileges once launched. It could drop a backdoor, create a new administrator account, disable security controls, or execute a reverse shell. The execution trigger occurs when the AnyDesk service is started — automatically at system reboot, upon user logon, or manually via services.msc. No user interaction is required for execution at boot time.

Step 4: Post-Exploitation Impact
The malicious executable runs with SYSTEM privileges, granting the attacker full control over the operating system. The attacker can install persistent backdoors (via new services, scheduled tasks, or registry Run keys), harvest credentials from the SAM database or LSASS process, disable endpoint protection, and pivot to other systems on the network using the compromised machine's privileges.

Note: No public PoC is available for this vulnerability; the attack chain is inferred from the vulnerability class and the technical description provided in the NVD entry.

Impact Assessment

The vulnerability enables a low-privileged local attacker to escalate to SYSTEM-level privileges — the highest privilege level on a Windows system. The CVSS base score of 8.5 (High) is driven by:

• Attack Vector: Local (AV:L) — requires local access.
• Attack Complexity: Low (AC:L) — exploitation is straightforward.
• Privileges Required: Low — any unprivileged account suffices.
• User Interaction: None — no action required from a legitimate user.
• Scope: Changed — the compromised service runs in a security context beyond the attacker's scope.
• CIA Impact: High/High/High — full confidentiality, integrity, and availability compromise.

Business impact for enterprises running AnyDesk 2.5.0 is severe. The software is commonly used for legitimate remote administration, but a compromised AnyDesk installation effectively hands the attacker the same access level as the organization's own IT administrators. The blast radius includes all data accessible from the compromised machine, lateral movement capability into the broader network, and potential for ransomware deployment. The lack of a patch increases the risk profile, making mitigation purely operational.

Organizations affected include any enterprise, managed service provider, or government entity with AnyDesk 2.5.0 deployed on employee workstations or servers. Legacy deployments are the primary risk — environments where version upgrades have been deferred or are blocked by application compatibility requirements.

Detection Guidance

The following detection rules are based on the vulnerability class and exploitation patterns. Since this is a local privilege escalation requiring file placement and service restart, detection focuses on anomalous file creation in critical directories and service-related events.

Sigma Rule

title: AnyDesk Unquoted Service Path Exploitation
id: 8f3a9d72-41b9-4c7e-9e51-2a4d5c6e7f80
status: experimental
description: Detects creation of executables in directories typically used for unquoted service path exploitation targeting AnyDesk 2.5.0
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2016-20094
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
    category: file_event
    product: windows
detection:
    selection_paths:
        TargetFilename|startswith:
            - 'C:\Program.exe'
            - 'C:\Program Files\AnyDesk.exe'
            - 'C:\Program Files\Anydesk.exe'
            - 'C:\Program Files\AnyDesk\AnyDesk.exe'
            - 'C:\Program.exe'
    selection_extension:
        TargetFilename|endswith:
            - '.exe'
            - '.dll'
    condition: selection_paths and selection_extension
falsepositives:
    - Legitimate software installation operations
    - Automated deployment tools
level: high

YARA Rule

rule CVE_2016_20094_AnyDesk_Unquoted_Service_Path
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2024-01-15"
        description = "Detects malicious binaries commonly deployed for unquoted service path exploitation against AnyDesk"
        cve = "CVE-2016-20094"
        severity = "high"
    strings:
        $service_cmd = "AnyDesk" nocase
        $path_token = "Program Files" nocase
        $service_mngr = "CreateService" nocase
        $elevation_api = "AdjustTokenPrivileges" nocase
        $backdoor_cmd = "cmd.exe /c net user" nocase
        $persistence = "ScheduleService" nocase
    condition:
        uint16(0) == 0x5A4D and
        2 of ($service_*) and
        (1 of ($elevation_api, $backdoor_cmd, $persistence))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2016-20094 AnyDesk Unquoted Service Path Exploitation Attempt";
    flow:established,to_server;
    content:"AnyDesk";
    content:"2.5.0";
    metadata:cve CVE-2016-20094;
    metadata:attack_target Windows;
    metadata:tag EoP;
    classtype:attempted-admin;
    sid:201620094;
    rev:1;
)

Note: Network-based detection of this local privilege escalation vulnerability is inherently limited. The above Suricata rule monitors for remote download of AnyDesk-related payloads, which may precede local exploitation. Host-based monitoring (file creation, service changes, process execution) is the primary detection vector.

Elastic Detection

sequence by host.name with maxspan=5s
  [file where event.action in ("creation", "modification") and
   file.name in ("Program.exe", "AnyDesk.exe", "AnyDeskService.exe") and
   file.path startswith ("C:\\Program", "C:\\Windows\\System32")]
  [process where event.action == "start" and
   process.name in ("Program.exe", "AnyDesk.exe") and
   process.Ext.windows.privileges == "SeDebugPrivilege"]

Splunk SPL Query

index=windows earliest=-24h
(SourceName="Microsoft-Windows-Sysmon" EventCode=11 AND TargetFilename="C:\\Program.exe" OR TargetFilename="C:\\Program Files\\AnyDesk.exe" OR TargetFilename="C:\\Program Files\\Anydesk.exe")
OR
(SourceName="Microsoft-Windows-Sysmon" EventCode=1 AND Image="C:\\Program.exe" OR Image="C:\\Program Files\\AnyDesk.exe")
| table _time, host, User, EventCode, Image, TargetFilename, CommandLine
| sort -_time

Wazuh OSSEC Rule

<group name="windows,sysmon,anydesk,">
  <rule id="173456" level="12">
    <if_sid>92050</if_sid>
    <field name="win.event.data.targetFilename">C:\\Program.exe|C:\\Program Files\\AnyDesk.exe|C:\\Program Files\\\\Anydesk.exe</field>
    <description>AnyDesk CVE-2016-20094: Suspicious executable created in unquoted service path directory</description>
    <group>pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
  </rule>
  <rule id="173457" level="12">
    <if_sid>92050</if_sid>
    <field name="win.event.data.image">C:\\Program.exe|C:\\Program Files\\AnyDesk.exe</field>
    <description>AnyDesk CVE-2016-20094: Suspicious process execution from unquoted path location</description>
    <group>pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch, hotfix, or updated version has been identified across any tracked source. The vendor has not published a security advisory for this vulnerability, and CISA has not added it to the Known Exploited Vulnerabilities catalog.

1) Immediate Mitigations (No Vendor Patch Available)

• Upgrade AnyDesk: Upgrade to any version newer than 2.5.0. While specific patched versions are not documented, newer major releases of AnyDesk incorporate proper service configuration with quoted paths.
• Manual Service Path Quoting: Modify the Windows service registry entry for AnyDesk to ensure the ImagePath value is enclosed in double quotation marks. This can be done via sc qc <service_name> to inspect and sc config <service_name> binPath="<full quoted path>" to correct it.
• Restrict Write Permissions: Audit and restrict write permissions on C:\ root and C:\Program Files\ directories. Standard users should have no write access to these locations.
• Disable Unused AnyDesk Services: If remote support is not actively used, disable the AnyDesk service to eliminate the exploitation vector.

2) Patch/Upgrade Steps

• Verify current AnyDesk version via the application's About dialog
• Download the latest version from the official AnyDesk website (https://www.anydesk.com/download)
• Uninstall version 2.5.0 before installing the new version
• Ensure the new installation uses quoted service paths by verifying with sc qc AnyDesk

3) Long-Term Hardening

• Inventory Management: Maintain a current inventory of all software versions deployed, with specific attention to remote access tools.
• Patch Management Process: Establish a cadence for updating remote administration software and treat these tools as high-priority targets.
• Least Privilege: Enforce least privilege across all endpoints — standard users should not have write access to system directories or the ability to create/stop services.
• Application Allowlisting: Deploy application control solutions (e.g., AppLocker, Windows Defender Application Control) to block execution of unknown binaries in critical directories.
• Monitoring: Implement the detection rules provided above, and monitor for anomalous service creation, file creation in unexpected directories, and unusual process execution patterns.
• Network Segmentation: Isolate systems running remote access tools, particularly legacy versions, to limit lateral movement if compromised.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2016-20094
   Official NVD record for this vulnerability, including the provided description and CVSS score.

2. CWE-428: Unquoted Search Path or Element — https://cwe.mitre.org/data/definitions/428.html
   The MITRE CWE description of the vulnerability class, detailing the root cause and common exploitation patterns.

3. AnyDesk Official Website — https://www.anydesk.com/download
   Vendor download page for obtaining updated versions of AnyDesk software (currently no fixed version identified for this specific CVE).

4. ATT&CK Technique T1068 — https://attack.mitre.org/techniques/T1068/
   MITRE ATT&CK reference for Exploitation for Privilege Escalation, the primary technique associated with this vulnerability.

5. CISA Known Exploited Vulnerabilities — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
   Reference source confirming this CVE is NOT listed in the KEV catalog and has no known exploitation in the wild.

Threat Actor Campaign Notes: No known threat actor campaigns or in-the-wild exploitation have been associated with CVE-2016-20094 as of the CISA KEV status ("NO"). The EPSS score of 0.00181 (7.9th percentile) indicates a low current exploitation probability. However, the vulnerability's unpatched status and ease of exploitation make it an attractive target for local privilege escalation, particularly in environments where legacy software is allowed to persist.