CVE-2025-27919: High severity AnyDesk AnyDesk vulnerability
An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and create a password for the Full Access profile without needing confirmation from the counterparty. Consequently, the attacker can later connect without this counterparty confirmation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27919?
CVE-2025-27919 is classified as a high severity vulnerability due to its potential to allow unauthorized access and control over remote settings.
How do I fix CVE-2025-27919?
To address CVE-2025-27919, users should update AnyDesk to version 9.0.5 or later, as this version resolves the security issue.
Who is affected by CVE-2025-27919?
CVE-2025-27919 affects AnyDesk versions up to 9.0.4 on all supported platforms, including Windows.
Can CVE-2025-27919 be exploited by remote attackers?
Yes, CVE-2025-27919 can be exploited by remote attackers who have been granted 'Control my device' permission.
What kind of access do attackers gain through CVE-2025-27919?
Attackers exploiting CVE-2025-27919 can manipulate remote settings and create full access passwords without any confirmation from the target user.