CVE-2020-13160
CVE-2020-13160
Vexday Risk Score
60Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 80.6%KEV nãoPoC públicaNuclei —Metasploit simPatch —
Lifecycle
09 Jun 2020Published on NVD
16 Jun 2020Metasploit module available
03 Mar 2021Public PoC
Weaponization speed
266 daysto first PoC
6 daysto Metasploit module
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Plan a near-term fix — a public PoC already exists.
AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.
Affected products
n/a · n/apublic PoCs found — 3
cve_referencepacketstormsecurity.com/files/158291/AnyDesk-GUI-Format-String-Write.htmlunverifiedcve_referencepacketstormsecurity.com/files/161628/AnyDesk-5.5.2-Remote-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49613unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.