[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flPwQy1SEeCleDfaZ_taL01SRs3wtDPl7U_hxW7O9OYQ":3},{"article":4,"iocs":40,"watch_terms":49,"solutions":50,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"b8c6ab45-58c8-47e9-9ae7-1acf9d9bda57","Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access","researchers-publish-working-exploit-for-pre-auth-anydesk-linux-flaw-that-gives-r-b8e2f3","Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as \"fixed a bug that could lead to a crash,\" with no CVE assigned and no security","Security researchers have published a full working exploit (AnyPwn) for a pre-authentication remote code execution vulnerability in AnyDesk Linux that allows attackers to gain root access without user approval. The flaw is a heap buffer overflow in AnyDesk's session protocol that AnyDesk patched in version 8.0.3 in June 2024 without disclosure or CVE assignment. The exploit targets direct TCP connections on port 7070 and uses integer overflow arithmetic to corrupt heap memory and execute arbitrary commands via ROP chains.","Researchers publish working exploit for pre-auth AnyDesk Linux heap overflow giving root access","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fresearchers-publish-working-exploit-for.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgnUnGcAOHQNX9naCpXjsvEAI4YXmS_pbFwgn9i_YTjR8esP-PpNXc0s-jOWo3r_M4S-an0mnZA4PwDjt3lOihJqWP60TMj3F37iIno8hynwj5xXex2Voy3Khj3QraiYO7oyeEgNtZtjB5q-FYXg9E0hNk93q7mTKdhBdPNGr0p1I35R0wxuY0IOmAlG_E\u002Fs1600\u002Fanyrun.gif","2026-10-09T12:59:22+00:00","2026-10-09T16:00:31.450102+00:00",9,[17,20,23,26],{"name":18,"type":19},"AnyDesk Linux","product",{"name":21,"type":22},"AnyDesk","vendor",{"name":24,"type":25},"Rick de Jager \u002F V12 Security Team","threat_actor",{"name":27,"type":28},"Heap buffer overflow","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",[41,45],{"type":42,"value":43,"context":44},"malware","AnyPwn","Published exploit for AnyDesk Linux heap buffer overflow RCE",{"type":46,"value":47,"context":48},"cve","CVE-2025-27918","Separate AnyDesk heap buffer overflow in user image processing, fixed in version 7.0.0 April 2025",[21,18],{"controls":51,"vendors":135},[52,81,106],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,90,98],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":82,"product_name":87,"url":88,"description":89},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":107,"name":108,"problem":109,"products":110},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":153},"anydesk-linux-root-exploit-highlights-silent-patching-dangers","AnyDesk Linux Root Exploit Highlights Silent Patching Dangers","A critical pre-authentication heap buffer overflow in AnyDesk for Linux allows unauthenticated attackers to gain root access via TCP port 7070, with a fully working public exploit now available. AnyDesk silently patched the flaw in version 8.0.3 in June 2024 without issuing a CVE or public disclosure, leaving many administrators unaware of the severity and urgency of the update. This 'silent patching' practice is particularly dangerous because organizations cannot prioritize remediation without visibility into the risk. The availability of a working exploit (AnyPwn) dramatically narrows the window for defenders to patch before attacks occur. Remote access tools with direct TCP exposure represent a high-value attack surface that demands proactive monitoring and rapid patch cycles.",[141,142,143,144,145,146,147,148,149,150,151,152],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST CM-6: Configuration Settings","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL Change Management: Emergency Change Procedures","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1068: Exploitation for Privilege Escalation",{}]