CVE-2025-27916

Executive Summary

CVE-2025-27916 is a critical security vulnerability affecting AnyDesk remote desktop software for Windows (before 9.0.6) and Android (before 8.0.0). The flaw allows an adversary-in-the-middle (AitM) attacker to manipulate data and spoof the AnyDesk ID when a connection is established via an IP address. This undermines the trust model of the remote desktop session, enabling identity spoofing and potential data interception. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the impact, it is assessed as High severity. No public proof-of-concept (PoC) or exploit code is currently available, but the attack vector is network-based and requires user interaction (initiating a connection via IP).

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It affects a standalone desktop application (AnyDesk) distributed via official channels. The supply chain risk is limited to the integrity of the AnyDesk binary itself, which should be verified via digital signatures.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (AV:N) – The attack is performed over the network.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – The attacker does not need prior access.
• User Interaction (UI): Required (UI:R) – The victim must initiate a connection via IP address.
• Scope (S): Unchanged (S:U) – The vulnerable component and the attacker are in the same security authority.
• Confidentiality (C): High (C:H) – Data in transit can be intercepted.
• Integrity (I): High (I:H) – The attacker can spoof the AnyDesk ID and manipulate data.
• Availability (A): None (A:N) – The vulnerability does not affect availability.

Threat Level: High (Estimated CVSS 8.1). The lack of a public PoC reduces immediate risk, but the ease of exploitation (network access, low complexity) makes it attractive for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the connection establishment logic of AnyDesk. When a client initiates a connection to another client using an IP address (rather than the AnyDesk ID), the protocol does not properly authenticate the identity of the remote endpoint. An attacker positioned on the network path (e.g., on the same Wi-Fi, compromised router, or via ARP spoofing) can intercept the initial handshake.

Attack Flow:

1. The victim (AnyDesk client) attempts to connect to a target machine using its IP address.
2. The attacker, acting as a man-in-the-middle, intercepts the connection request.
3. The attacker manipulates the data packets to spoof the AnyDesk ID of the intended target.
4. The victim’s client accepts the spoofed ID, believing it is connected to the legitimate target.
5. The attacker can now relay, modify, or eavesdrop on the remote desktop session.

The root cause is a lack of cryptographic verification of the AnyDesk ID during IP-based connections. The ID should be bound to the session via a trusted channel (e.g., TLS with mutual authentication), but the implementation allows the ID to be forged.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Simplified representation of vulnerable handshake
def handle_ip_connection(ip_address):
    # No verification of AnyDesk ID
    remote_id = receive_id_from_peer()
    session = create_session(remote_id)
    # Attacker can inject arbitrary ID

Patched Code (Conceptual):

def handle_ip_connection(ip_address):
    # Establish TLS with certificate pinning
    tls_session = tls_connect(ip_address, verify_cert=True)
    # Verify AnyDesk ID via signed token
    remote_id = receive_signed_id(tls_session)
    if verify_signature(remote_id, tls_session.peer_cert):
        session = create_session(remote_id)
    else:
        reject_connection()

The patch introduces mandatory TLS with certificate validation and signed identity tokens, preventing ID spoofing.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Attacker machine with network access (e.g., Kali Linux).
• Vulnerable AnyDesk client (Windows < 9.0.6 or Android < 8.0.0).
• Target machine running AnyDesk.

Steps:

1. Set up ARP spoofing to intercept traffic between victim and target:

   arpspoof -i eth0 -t <victim_ip> <target_ip>
   arpspoof -i eth0 -t <target_ip> <victim_ip>
   

2. Use a custom proxy (e.g., mitmproxy) to intercept AnyDesk traffic on port 7070 (default).
3. Modify the AnyDesk ID field in the handshake packets to a controlled ID.
4. Victim connects to the spoofed ID, granting the attacker session access.

Note: No public exploit code is available. The above is a conceptual attack path.

Blue Team (Defense & Detection)

Detection:

• Monitor for ARP spoofing indicators (e.g., duplicate IP addresses in ARP tables).
• Alert on AnyDesk connections initiated via IP address (log event ID 1001 in AnyDesk logs).
• Use network anomaly detection for unexpected TLS handshake failures.

Prevention:

• Enforce use of AnyDesk IDs instead of IP addresses for connections.
• Deploy network segmentation and 802.1X authentication.
• Use VPNs for remote desktop access.

Indicators of Compromise (IOCs)

• Network: Unusual ARP replies (MAC address changes for gateway IP).
• AnyDesk Logs: Connection events with type=ip and mismatched remote_id.
• Process: anydesk.exe (Windows) or com.anydesk.anydeskandroid (Android) initiating connections to unexpected IPs.
• Registry (Windows): HKLM\SOFTWARE\AnyDesk\Software\AnyDesk\ConnectionHistory containing IP-based entries.

Detection Engineering

YARA Rule

rule CVE_2025_27916_AnyDesk_Spoofing {
    meta:
        description = "Detects AnyDesk versions vulnerable to CVE-2025-27916"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-27916"
    strings:
        $vuln_windows = "AnyDesk 9.0." ascii wide nocase
        $vuln_android = "AnyDesk 8.0." ascii wide nocase
    condition:
        $vuln_windows or $vuln_android
}

Sigma Rule

title: AnyDesk IP-Based Connection Attempt
id: 8f4b3c2a-1d5e-4f7b-9a0c-3e6d8f2b1a4c
status: experimental
description: Detects AnyDesk connections initiated via IP address, indicating potential exploitation of CVE-2025-27916
author: Valters IT
logsource:
    product: windows
    service: anydesk
detection:
    selection:
        EventID: 1001
        ConnectionType: 'IP'
    condition: selection
falsepositives:
    - Legitimate use of IP-based connections in controlled environments
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 7070 (msg:"CVE-2025-27916 AnyDesk ID Spoofing Attempt"; flow:to_server; content:"|00 0c|"; depth:2; content:"|41 6e 79 44 65 73 6b|"; distance:0; within:7; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade AnyDesk for Windows to version 9.0.6 or later.
2. Upgrade AnyDesk for Android to version 8.0.0 or later.
3. Disable IP-based connections in AnyDesk settings (if possible).

Long-Term Measures:

• Implement network-level encryption (e.g., IPsec) for all remote desktop traffic.
• Use certificate-based authentication for AnyDesk sessions.
• Conduct regular vulnerability scans and patch management.

Workarounds:

• If patching is not possible, restrict AnyDesk to ID-based connections only and block port 7070 at the firewall for external IPs.

Valters IT