AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege

The AnyDesk 2.5.0 service is installed with an unquoted binary path (`C:\Program Files\AnyDesk\AnyDesk.exe`), and the service runs with SYSTEM privileges [ref_id=1]. A local, non-privileged user who can write to a parent directory in the unquoted path (for example, `C:\Program.exe` or `C:\Program Files\AnyDesk.exe`) can place a malicious executable there. When the service starts (automatically at boot or manually), Windows' CreateProcess resolves the unquoted path by first checking the space-split tokens, causing the attacker's planted executable to be launched with SYSTEM privileges instead of the intended AnyDesk binary [ref_id=1].

The vendor must enclose the service binary path in quotation marks (`"C:\Program Files\AnyDesk\AnyDesk.exe"`) so that Windows interprets the entire string as a single path and does not attempt to resolve space-delimited tokens as separate executables. The advisory does not include a specific patch diff, but the standard remediation for CWE-428 (Unquoted Search Path or Element) is to quote the service binary path in the registry or service configuration [ref_id=1]. Without this change, any directory in the unquoted path that an unprivileged user can write to becomes an elevation-of-privilege vector.