# CVE-2025-27919: An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission…

Source: https://junglewise.ai/threats/cve-2025-27919-an-issue-was-discovered-in-anydesk-through-9-0-4-a-remotely  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-06  
License: CC BY 4.0 with a link back

CVE-2025-27919 · Severity: high · CVSS 8.2 · Published 2025-11-06

An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and create a password for the Full Access profile without needing confirmation from the counterparty. Consequently, the attacker can later connect without this counterparty confirmation.

Technologies: [AnyDesk](https://junglewise.ai/threats/technologies/anydesk). Vendors: [AnyDesk](https://junglewise.ai/threats/vendors/anydesk).

## Quick answers

**Is CVE-2025-27919 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-27919 being exploited in the wild.

**How severe is CVE-2025-27919?** High severity, with a CVSS score of 8.2, published 6 November 2025.

**Which products and versions are affected?** AnyDesk. The advisory does not name versions.

**Is there a fix for CVE-2025-27919?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-27919?** Check whether you run AnyDesk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- AnyDesk

## Related threats

- [AnyDesk heap buffer overflow in session protocol mode 5](https://junglewise.ai/threats/cve-2026-109390-anydesk-before-8-0-3-allows-unauthenticated-remote-attackers-to)
- [AnyDesk link following denial of service in Send Support Information](https://junglewise.ai/threats/cve-2026-15682-anydesk-link-following-denial-of-service-in-send-support)
- [AnyDesk link following denial of service in screen recording](https://junglewise.ai/threats/cve-2026-15681-anydesk-link-following-denial-of-service-in-screen-recording)
- [AnyDesk unquoted service path in AnyDesk Service](https://junglewise.ai/threats/cve-2016-20094-anydesk-unquoted-service-path-in-anydesk-service)
- [AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local…](https://junglewise.ai/threats/cve-2019-25261-anydesk-5-4-0-contains-an-unquoted-service-path-vulnerability-in)