AnyDesk Linux AnyPwn Exploit Grants Remote Root Access
Bypassing the Confirmation Prompt
The standard remote access confirmation window has proven entirely ineffectual against a critical flaw. This severe vulnerability triggers well before any prompt reaches the user. The V12 research team recently published a working AnyPwn exploit tailored for AnyDesk on Linux systems. This sophisticated exploit enables root-level command execution without necessitating a password or connection authorization. Consequently, mere network access to the vulnerable service provides sufficient leverage to launch a devastating attack.
Understanding the Vulnerability Mechanism
AnyPwn specifically targets AnyDesk Linux version 8.0.2. It aggressively compromises the service via a direct TCP connection on port 7070. The fundamental vulnerability resides within the session protocol packet handler. This flaw ultimately culminates in a severe heap buffer overflow. Because the AnyDesk service inherently operates with elevated root privileges in Linux environments, successful exploitation instantly bestows maximum system authority and complete host control upon the attacker.
The Buffer Size Calculation Error
This critical error originates during the buffer size calculation process. The handler mathematically adds a 16-byte header to the declared data length. It utilizes 32-bit arithmetic devoid of essential overflow verification. Following the addition of 0x10, the maximum value of 0xFFFFFFF0 disastrously wraps around to zero. Therefore, the program allocates an inadequately small memory segment. Nevertheless, it persists in treating the packet length as massive. This forces the system to write arbitrary data far beyond the legitimate boundaries of the allocated buffer.
Executing the ROP Chain Attack
Following the systematic corruption of adjacent memory objects, the exploit intelligently employs a ROP chain. It meticulously assembles command execution instructions from pre-existing machine code fragments scattered throughout the system. However, this complex attack does not guarantee absolute success on the initial attempt. If the targeted object does not reside immediately adjacent to the overflowed buffer, the service simply crashes abruptly. Furthermore, the published memory offsets are strictly calculated for the specific 8.0.2 software build.
Silent Patches and Missing CVEs
Security specialists officially reported this alarming problem on June 22. In swift response, AnyDesk released version 8.0.3 by June 23. Within the official changelog, the company merely noted the resolution of a bug capable of causing a system crash. They notably omitted a dedicated security bulletin. As of mid-October, the AnyPwn vulnerability lacks an assigned CVE identifier. Consequently, an official CVSS severity score remains conspicuously absent. This subdued presentation might have inadvertently diminished the perceived urgency of the June update among network administrators.
Scope of the AnyPwn Exploit
A fully weaponized exploit is currently demonstrated exclusively for direct connections targeting TCP port 7070. The V12 team also successfully reached the vulnerable code execution path through AnyDesk relay servers. However, they abstained from demonstrating a functional root-acquisition exploit chain utilizing that specific route. AnyDesk previously affirmed that this severe issue remains strictly limited to direct Linux connections. Fortunately, the Windows and macOS iterations remain completely unaffected by this fundamental flaw.
Protection and Mitigation Strategies
Currently, there remains no public confirmation of malicious attacks leveraging the AnyPwn vulnerability in the wild. To ensure robust protection, cybersecurity experts strongly recommend updating AnyDesk Linux to version 8.0.3 at a minimum. Ideally, administrators should upgrade immediately to the most current 8.1.0 release. If an immediate update proves unfeasible, network access to TCP port 7070 must be strictly limited to trusted, verified nodes. While researchers previously discovered another vulnerability capable of disrupting AnyDesk operations, this new AnyPwn exploit represents a vastly more dangerous threat due to its remote root command execution capabilities.
