Affected Systems
AnyDesk for Linux versions prior to 8.0.3 (specifically 8.0.2 confirmed vulnerable). Heap buffer overflow in session protocol on TCP port 7070. Windows and macOS not affected. Patched in version 8.0.3 (June 2024); current version is 8.1.0.
Exploitation Status
Working public exploit (AnyPwn) published on GitHub October 8, 2024. Exploit is probabilistic and targets direct TCP connections on port 7070. Researchers validated vulnerable code path is reachable via AnyDesk relay servers but did not demonstrate full relay-based exploit. No reports of active in-the-wild exploitation.
Business Impact
Attackers with network access to TCP port 7070 can execute arbitrary code as root on vulnerable AnyDesk Linux installations before any user interaction or connection approval. The exploit leverages a heap buffer overflow caused by 32-bit integer wraparound in session protocol packet handling. AnyDesk silently patched the flaw in June 2024 without CVE assignment or security advisory, describing it only as a crash fix. Organizations running outdated AnyDesk Linux versions face pre-authentication remote compromise risk. Exploit reliability depends on heap layout; failed attempts crash the service.
Urgency
🔴 Immediate
Recommended Actions
- Update AnyDesk for Linux to version 8.0.3 or later (current release is 8.1.0) immediately on all systems.
- Audit network access controls to restrict TCP port 7070 to trusted networks only; block external access if direct connections are not required.
- Inventory all Linux endpoints running AnyDesk using asset management or EDR tools; prioritize systems exposed to untrusted networks.
- Monitor AnyDesk service logs and system logs for unexpected crashes or restarts on Linux hosts, which may indicate failed exploitation attempts.
- Consider disabling AnyDesk on Linux systems where remote desktop access is not actively required until patching is complete.