Main Vulnerability Database Vulnerabilities #VU29530

Format string error in AnyDesk for Linux and AnyDesk for BSD - CVE-2020-13160

Published: July 6, 2020 / Updated: July 12, 2020

Vulnerability identifier: #VU29530

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-13160

CWE-ID: CWE-134

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a format string error when processing hostames. A remote attacker can supply a specially crafted input that contains format string specifiers and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

AnyDesk for Linux
AnyDesk for BSD

How to mitigate CVE-2020-13160

Install updates from vendor's website.

AnyDesk for Linux - update to 5.5.3
AnyDesk for BSD - update to 5.5.3

Links to Public Exploits and PoC-codes

Exploit #3067 - AnyDesk GUI Format String Write (July 12, 2020)

External References

Related Security Bulletins

Remote code execution in AnyDesk for Linux and BSD