Security researchers have unveiled a new exploit, AnyPwn, that targets a significant vulnerability in AnyDesk Linux. This flaw, located in the remote desktop tool’s session protocol, allows attackers to gain root access without authentication. The exploit was publicly released on GitHub on October 8, prompting administrators to ensure their systems are updated to at least version 8.0.3 to mitigate potential risks.
Details of the AnyDesk Exploit
The exploit leverages a heap buffer overflow within AnyDesk’s session management, specifically affecting direct TCP connections via port 7070. Successful execution requires precise conditions, such as the alignment of a target object next to the overflow buffer. The code, as released, is tailored for AnyDesk Linux version 8.0.2, with other versions requiring custom adjustments to the offsets.
Despite the lack of an assigned CVE or an official security advisory from AnyDesk, the urgency to update is clear. The company has acknowledged the vulnerability, affecting direct Linux connections while clarifying that Windows and macOS versions remain unaffected.
Understanding the Vulnerability Mechanism
AnyDesk’s session protocol uses mode-5 stream packets, where a miscalculation in the buffer allocation size creates the vulnerability. The flaw arises when a payload length of 0xFFFFFFF0 is declared, resulting in a zero-sized allocation due to arithmetic overflow. This allows malicious data to overflow into adjacent memory spaces, potentially executing commands with root privileges.
Rick de Jager from the V12 security team, using the V12 code review engine, identified the flaw. This discovery is part of a broader security landscape involving other vulnerabilities, like the previously patched CVE-2025-27918, which affected multiple platforms through a different mechanism.
Recommendations and Future Implications
Administrators are urged to upgrade to the latest version, 8.1.0, and restrict access to TCP port 7070 as an immediate precaution. While the exploit’s full potential over relay servers remains unconfirmed, ongoing vigilance and prompt software updates are essential in maintaining system security.
This incident underscores the critical importance of transparency and timely communication in cybersecurity. As vulnerabilities arise, the ability to quickly patch and inform users is paramount in safeguarding against potential exploits.
