AnyDesk Support Information Link Following DoS Vulnerability

Executive Summary

CVE-2026-15682 is a denial-of-service vulnerability in AnyDesk software. It affects the 'Send Support Information' feature, where a local attacker with low-privileged code execution can exploit the flaw.

The vulnerability exists because an attacker can create a junction (a type of symbolic link) to abuse the service and create arbitrary files on the system. This abuse leads to a denial-of-service condition, disrupting normal system operations.

To exploit this, the attacker must first gain the ability to execute low-privileged code on the target system. The vulnerability does not require user interaction and has a CVSS base score of 4.7, indicating medium severity.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for signs of exploitation or misconfiguration related to AnyDesk's 'Send Support Information' feature. Since the vulnerability involves creating junctions to abuse file creation, you can look for unusual file activity or junctions pointing to sensitive directories.

• Check for AnyDesk installations: Verify if AnyDesk is installed on the system. On Windows, you can use the following command in Command Prompt or PowerShell: 'wmic product where name="AnyDesk" get name,version'.
• Inspect junction points: Use the 'dir /al' command in Command Prompt to list junction points in the system. Look for suspicious junctions that might be pointing to critical directories.
• Monitor file creation: Use Windows Event Logs or tools like Process Monitor to track file creation events related to AnyDesk processes. Filter for events involving 'AnyDesk.exe' or related services.
• Check for low-privileged code execution: Review logs or security tools for evidence of low-privileged code execution, as this is a prerequisite for exploitation.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of AnyDesk, this vulnerability could impact you in the following ways:

• A local attacker with low-privileged access to your system could exploit this flaw to cause a denial-of-service condition. This means critical services or applications on your system may become unresponsive or crash.
• The attacker could create arbitrary files on your system, potentially leading to further exploitation or disruption of system functionality.
• Since the vulnerability does not require user interaction, an attacker could exploit it silently once they have low-privileged access to your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with common standards and regulations in the following ways:

• GDPR: If the denial-of-service condition or arbitrary file creation leads to a disruption of services handling personal data, it could violate GDPR's requirements for data availability and integrity. Organizations must ensure the protection of personal data against accidental or unlawful destruction, loss, or alteration.
• HIPAA: For organizations handling protected health information (PHI), a denial-of-service condition could disrupt access to critical healthcare systems, violating HIPAA's requirements for ensuring the availability and integrity of PHI. Additionally, unauthorized file creation could lead to unauthorized access or modification of PHI.
• Other standards like ISO 27001 or NIST frameworks require organizations to manage vulnerabilities and ensure system availability. Failure to patch or mitigate this vulnerability could result in non-compliance with these standards.

However, the specific impact on compliance depends on how the vulnerability is exploited and the nature of the data or systems affected in your environment.

Useful 0 Not Useful 0

Mitigation Strategies

Since the vendor has deemed this issue out of scope and no patch is available, the primary mitigation is to restrict interaction with the AnyDesk software or limit its functionality.

• Restrict access to AnyDesk: Disable or uninstall AnyDesk if it is not essential for operations. On Windows, you can uninstall it via 'Control Panel > Programs > Uninstall a program' or using the command: 'wmic product where name="AnyDesk" call uninstall'.
• Limit user privileges: Ensure that users do not have low-privileged code execution capabilities on systems running AnyDesk. Apply the principle of least privilege to minimize the risk of exploitation.
• Monitor for suspicious activity: Deploy monitoring tools to detect unusual file creation or junction point manipulation, especially in sensitive directories.
• Apply network-level restrictions: If AnyDesk must remain installed, restrict its network access using firewalls or endpoint protection tools to limit its interaction with external systems.

Useful 0 Not Useful 0