Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access

Security researchers from the V12 team have released a fully functional exploit, dubbed AnyPwn, for a pre-authentication remote code execution bug in AnyDesk Linux that lets an attacker gain root access before any connection is approved. The flaw is a heap buffer overflow in AnyDesk's session protocol, caused by unchecked 32-bit integer arithmetic that lets a crafted packet size wrap to zero, triggering a tiny allocation while a large length is still recorded, which attackers can abuse via a ROP chain to execute arbitrary commands as root. The researchers notified AnyDesk in June, and the vendor silently patched it in version 8.0.3 without assigning a CVE or publishing a security advisory, describing the fix only as a crash-related bug fix. The exploit, published on GitHub on October 8, specifically targets direct TCP connections on port 7070 in build 8.0.2 and is probabilistic, while AnyDesk states that macOS and Windows are unaffected and that relay-based connections are not exploitable, though the researchers showed the vulnerable code path is still reachable through relays. Administrators should update to AnyDesk Linux 8.1.0 or restrict access to port 7070 if an immediate update isn't possible.