PT-2020-13365 · Philipp Heckel+1 · Anydesk

Published 2020-06-09 · Updated 2021-03-15 · CVE-2020-13160

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AnyDesk versions prior to 5.5.3

Description The issue is related to a format string vulnerability that can be exploited for remote code execution.

Recommendations For versions prior to 5.5.3, update to version 5.5.3 or later to resolve the issue.

Exploit

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2020-13160

Affected Products

Anydesk

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/cve_2020_13160_anydesk.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/161628/AnyDesk-5.5.2-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/158291/AnyDesk-GUI-Format-String-Write.html · Exploit
• 🔥 https://devel0pment.de/?p=1881 · Exploit
• 🔥 https://exploit-db.com/exploits/49613 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13160 · Security Note
• https://download.anydesk.com/changelog.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13160 · Vendor Advisory
• https://t.me/cvenotify/11351 · Telegram Post
• https://github.com/advisories/GHSA-5hwp-hcwg-rrjp · Note