CVE-2020-13160: AnyDesk Linux and FreeBSD format string remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and public exploit references make this a high-impact remote code execution flaw.

What it is

AnyDesk before 5.5.3 on Linux and FreeBSD contains a format string vulnerability (CWE-134) that can be exploited for remote code execution. The flaw is network reachable with no privileges or user interaction required, making it a serious pre-auth risk for exposed AnyDesk endpoints.

Impact

An attacker can execute arbitrary code on the affected host, gaining full control of the AnyDesk process and potentially the underlying system.

Attack surface

Reached over the network via the AnyDesk service on Linux and FreeBSD; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.80551, 99.6th percentile) and multiple references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade AnyDesk to 5.5.3 or later on Linux and FreeBSD (see vendor changelog).
• Restrict network exposure of AnyDesk ports to trusted hosts and block untrusted internet access.
• Run AnyDesk with least privilege and avoid running it as root where possible.
• Monitor vendor advisories and apply future AnyDesk security updates promptly.

Detection

• Monitor for unexpected crashes or abnormal process behavior in AnyDesk on Linux/FreeBSD hosts.
• Alert on AnyDesk network connections from untrusted or unusual source addresses.
• Review host logs for suspicious child processes or code execution spawned by AnyDesk.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.