Source: The Hacker News, Cyber Security News, Security Online
Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk for Linux that hands attackers root access before anyone approves the connection. The vulnerability, nicknamed AnyPwn by the V12 research team, affects AnyDesk Linux 8.0.2 running in service mode on x86_64 systems. AnyDesk released version 8.0.3 with the fix back in June, but the changelog described it only as a fix for a bug that could lead to a crash. No CVE identifier has been assigned and no security advisory was ever published, which means many administrators never knew there was a reason to update.
How the exploit works
The flaw sits in AnyDesk’s session protocol, the code that handles information exchanged when a remote client connects. An integer overflow in the payload size calculation lets an attacker send a small packet that claims a huge amount of data, creating an out-of-bounds heap write. The published exploit corrupts adjacent heap objects and uses a ROP chain to run an arbitrary command as root over a direct connection to TCP port 7070. Because the Linux service normally runs as root, successful exploitation gives the attacker privileged execution with no credentials and no user interaction. Exploitation is probabilistic and depends on the memory layout of the exact build, and an unsuccessful attempt may simply crash the service. The researchers also confirmed that the same vulnerable code path is reachable through AnyDesk relay servers, although they did not demonstrate the full root execution chain through relays.
Why this matters for European infrastructure
Remote access tools are a fact of life in European IT operations, and they are routinely installed on high-value servers, jump hosts and industrial systems where they run with full privileges. A silent patch is the worst case for that kind of software, because the population of unpatched installs stays large for years. Administrators should immediately inventory their Linux estates for AnyDesk 8.0.2 or older, upgrade to 8.0.3 or later, and restrict untrusted access to TCP port 7070 in the meantime. Restricting the port reduces exposure but does not replace patching, since relay reachability is confirmed.
If your organization needs help auditing remote access exposure across Linux fleets, tightening firewall rules or building a patch process that does not depend on vendors publishing CVEs, contact Excello Digital at https://excello.digital/contact/. We help European companies find and fix exactly this class of silent risk before someone else does.