A newly exposed vulnerability in AnyDesk Linux has been brought to light by security researchers, revealing a significant flaw that allows remote code execution without prior authentication. This vulnerability, named AnyPwn, exploits a heap buffer overflow in AnyDesk's session protocol, granting attackers root access without user approval. Although AnyDesk patched this flaw in version 8.0.3 back in June, the release notes only vaguely mentioned fixing a bug that could lead to a crash, and no CVE was assigned.

The exploit code, publicly shared on GitHub on October 8, works primarily over direct TCP connections on port 7070, although researchers have suggested that the same code path might be exploited via AnyDesk's relay servers. The exploit requires a specific heap layout to succeed; otherwise, the service crashes instead of executing the attacker's command. The current offsets in the exploit target AnyDesk Linux version 8.0.2, and different builds would need different values.

Administrators are strongly advised to update AnyDesk to at least version 8.0.3, with the latest available version being 8.1.0. Those unable to update immediately should at least restrict access to TCP port 7070 to mitigate risk. While AnyDesk confirmed that Windows and macOS platforms remain unaffected, they have not issued a formal security advisory regarding this vulnerability.

This issue was originally reported by Rick de Jager of the V12 security team, who utilized the V12 security code review engine to discover the flaw. Despite AnyDesk's efforts to address the vulnerability, the absence of a CVE and formal advisory leaves a gap in the security community’s ability to track and respond to this threat. Further complicating matters, the exploit's applicability over relay connections remains an open question, necessitating ongoing scrutiny and caution from system administrators.