Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access
Researchers publish working exploit for pre-auth AnyDesk Linux heap overflow giving root access
Security researchers have published a full working exploit (AnyPwn) for a pre-authentication remote code execution vulnerability in AnyDesk Linux that allows attackers to gain root access without user approval. The flaw is a heap buffer overflow in AnyDesk's session protocol that AnyDesk patched in version 8.0.3 in June 2024 without disclosure or CVE assignment. The exploit targets direct TCP connections on port 7070 and uses integer overflow arithmetic to corrupt heap memory and execute arbitrary commands via ROP chains.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AnyDesk?
Get an email when a new story names AnyDesk, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical pre-authentication heap buffer overflow in AnyDesk for Linux allows unauthenticated attackers to gain root access via TCP port 7070, with a fully working public exploit now available. AnyDesk silently patched the flaw in version 8.0.3 in June 2024 without issuing a CVE or public disclosure, leaving many administrators unaware of the severity and urgency of the update. This 'silent patching' practice is particularly dangerous because organizations cannot prioritize remediation without visibility into the risk. The availability of a working exploit (AnyPwn) dramatically narrows the window for defenders to patch before attacks occur. Remote access tools with direct TCP exposure represent a high-value attack surface that demands proactive monitoring and rapid patch cycles.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — AnyPwn
- cve — CVE-2025-27918