AnyDesk Linux vulnerability allows root access via AnyPwn exploit

Security researchers have released a working exploit, dubbed ‘AnyPwn’, targeting a pre-authentication remote code execution flaw in AnyDesk for Linux. The vulnerability exploits a heap buffer overflow in the software’s session protocol, allowing attackers to gain root access before a user can approve the connection.

The exploit specifically targets direct TCP connections on port 7070. While the attack is probabilistic—requiring a specific heap layout to succeed without crashing the service—researchers noted that the vulnerable code path may also be reachable via AnyDesk’s relay servers.

AnyDesk addressed the flaw in version 8.0.3, released in June, though the company’s changelog initially described the fix only as addressing a bug that could lead to a crash. No CVE has been assigned to the vulnerability, and no formal security advisory has been issued by the company. Administrators are advised to update AnyDesk Linux to at least version 8.0.3 or the latest release, 8.1.0. The vulnerability is limited to Linux; Windows and macOS versions are unaffected.