AnyDesk Linux Flaw Lets Remote Attackers Execute Code as Root Without Authentication

A working proof-of-concept for a serious AnyDesk Linux vulnerability that can let remote attackers run commands as root without authentication or user approval. The issue, named AnyPwn, affects AnyDesk Linux 8.0.2 and was fixed in version 8.0.3. Organizations using AnyDesk for Linux should update immediately and check whether TCP port 7070 is exposed to untrusted networks. The flaw was discovered by Rick de Jager of the V12 security team using V12, an AI-powered security review platform. V12 first disclosed the issue publicly in June and described it as a pre-authentication, zero-click remote code execution flaw caused by a heap buffer overflow. AnyPwn: AnyDesk preauth 0click RCE (heap buffer overflow)we will release PoC post...

Read the full article at the source.