CVE-2022-32450

AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and chat) but the product runs as SYSTEM when writing chat-room data there.

CVSS v3.1

7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0.54% chance of exploitation in the next 30 days, 43th percentile

Published

2022-07-18

Updated

2026-07-09

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/167608/AnyDesk-7.0.9-Arbitrary-File-Write-Denial-Of-…
• http://seclists.org/fulldisclosure/2022/Jul/9
• https://seclists.org/fulldisclosure/2022/Jun/44

References

• CVE Record
• NVD entry

Related

• CVE-2022-3245
• CVE-2022-32454
• CVE-2022-32444
• CVE-2022-3246
• CVE-2022-32441
• CVE-2022-3247