AnyDesk: AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges

Critical AnyDesk Linux Vulnerability (AnyPwn) Enables Remote Root Access

A security researcher has disclosed a heap buffer overflow vulnerability, dubbed AnyPwn, in AnyDesk Linux version 8.0.2, allowing remote command execution before user approval. Since the AnyDesk service typically runs with root privileges, successful exploitation grants attackers full root access to the system.

The flaw, identified by V12’s security team, resides in AnyDesk’s session protocol, specifically in its mode-5 stream packet handler. The vulnerability stems from improper validation of a payload length provided by a remote source, leading to an integer truncation issue when calculating memory allocation. An attacker can manipulate this to trigger a heap overflow, corrupting adjacent memory structures.

Exploitation Details:

• The attack targets TCP port 7070 on Linux x86_64 systems running AnyDesk 8.0.2 in service mode.
• A proof-of-concept (PoC) by researcher Rick de Jager demonstrates the exploit via direct connections, though adjustments would be needed for other builds.
• The attack combines allocator grooming and return-oriented programming (ROP) to corrupt dispatch fields in neighboring objects, redirecting execution to a ROP chain that calls system() with attacker-controlled commands.
• Success is probabilistic if the victim object isn’t adjacent to the corrupted buffer, the service may crash instead of executing the payload.
• While a Frida-based trigger can access the vulnerable path via AnyDesk relay connections, full relay-based exploitation has not been confirmed.

Impact & Mitigation:

• AnyDesk 8.0.3 patches the vulnerability, and administrators are advised to upgrade immediately.
• Windows and macOS versions are unaffected, as the flaw is limited to Linux direct connections.
• Temporary mitigation includes restricting access to TCP port 7070, though this does not replace patching.

The vulnerability highlights risks in privileged remote access tools and underscores the need for prompt updates in enterprise environments.

Source: https://gbhackers.com/anydesk-vulnerability/

AnyDesk TPRM report: https://www.rankiteo.com/company/anydesk-software-gmbh

"id": "any1791793511",
"linkid": "anydesk-software-gmbh",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Users of AnyDesk Linux version '
                                              '8.0.2',
                        'industry': 'Remote Access Software',
                        'name': 'AnyDesk',
                        'type': 'Software Vendor'}],
 'attack_vector': 'Remote Network Connection (TCP port 7070)',
 'customer_advisories': 'Upgrade to AnyDesk 8.0.3 immediately to patch the '
                        'vulnerability. Restrict access to TCP port 7070 as a '
                        'temporary measure.',
 'description': 'A heap buffer overflow vulnerability, dubbed AnyPwn, in '
                'AnyDesk Linux version 8.0.2 allows remote command execution '
                'before user approval. Successful exploitation grants '
                'attackers full root access to the system due to the service '
                'running with root privileges.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
                                       'critical vulnerability in remote '
                                       'access tool',
            'operational_impact': 'Remote root access, potential system '
                                  'compromise',
            'systems_affected': 'Linux x86_64 systems running AnyDesk 8.0.2 in '
                                'service mode'},
 'lessons_learned': 'Highlights risks in privileged remote access tools and '
                    'the need for prompt updates in enterprise environments.',
 'post_incident_analysis': {'corrective_actions': 'Patch vulnerability in '
                                                  'AnyDesk 8.0.3, improve '
                                                  'input validation in session '
                                                  'protocol handlers.',
                            'root_causes': 'Improper validation of payload '
                                           'length in AnyDesk’s session '
                                           'protocol, leading to integer '
                                           'truncation and heap overflow.'},
 'recommendations': 'Immediately upgrade to AnyDesk 8.0.3, restrict access to '
                    'TCP port 7070 as a temporary mitigation, and monitor for '
                    'unauthorized access.',
 'references': [{'source': 'V12’s security team'},
                {'source': 'Rick de Jager (Proof-of-Concept)'}],
 'response': {'containment_measures': 'Upgrade to AnyDesk 8.0.3, restrict '
                                      'access to TCP port 7070',
              'remediation_measures': 'Patch vulnerability by upgrading to '
                                      'AnyDesk 8.0.3'},
 'title': 'Critical AnyDesk Linux Vulnerability (AnyPwn) Enables Remote Root '
          'Access',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'Heap buffer overflow (CVE not specified)'}