AnyDesk Linux 8.0.2 Vulnerability Allows Unauthenticated Root Code Execution

Remote attackers can execute arbitrary code with root privileges on Linux systems running AnyDesk version 8.0.2 without requiring user authentication or approval. This capability stems from a vulnerability named AnyPwn, which allows exploitation through the service’s network interface before any desktop-sharing session is accepted.

The flaw was identified by Rick de Jager, a member of the V12 security team, who utilized the V12 AI-powered security review platform to detect the issue. According to Cyber Security News, V12 disclosed the vulnerability publicly in June, describing it as a pre-authentication, zero-click remote code execution flaw caused by a heap buffer overflow within the application’s memory handling.

View the original post on X

Technical Details and Timeline

AnyDesk acknowledged the report shortly after its initial disclosure and released version 8.0.3 in June to address the security gap. However, the release of public exploit code on October 8 has renewed attention on systems that may still be operating on the vulnerable 8.0.2 build. This public availability of proof-of-concept code increases the likelihood of automated scanning and targeted attacks against unpatched installations.

Technical documentation from V12 Security explains that the issue resides in AnyDesk’s session protocol, which manages data exchange during remote client connections. Specifically, the mode-5 stream packet handler processes remote payload lengths before performing safe validation. The software adds a 16-byte object header to this value using 32-bit arithmetic, creating a potential for integer overflow.

A specially crafted length value can cause this calculation to wrap around, leading the application to allocate a significantly smaller memory area than expected while treating it as a large object. This mismatch results in an out-of-bounds write condition, where attacker-controlled data is written beyond the allocated memory buffer. This corruption can overwrite nearby memory objects and redirect program execution under favorable conditions.

Impact on Linux Environments

The security impact is severe because the AnyDesk service typically runs with root privileges on Linux operating systems. Root access represents the highest privilege level, granting full control over files, processes, user accounts, and security settings. An attacker who successfully triggers this flaw can establish a strong foothold on the host machine before a victim ever approves a desktop-sharing request.

This characteristic distinguishes AnyPwn from many other remote-support risks that rely on stolen credentials, explicit user approval, or unattended-access passwords. The ability to execute commands without authentication means that exposure of the service to untrusted networks creates an immediate and critical risk. Organizations must verify whether TCP port 7070 is exposed to external networks, as this is the entry point for the attack.

What should you do?

Administrators should immediately verify the version of AnyDesk installed on all Linux hosts. If version 8.0.2 is detected, upgrading to version 8.0.3 or later is essential to mitigate the risk. Additionally, network configurations should be reviewed to ensure that TCP port 7070 is not accessible from untrusted or public networks, reducing the attack surface for remote exploitation attempts.

What to do and how to stay safe: AnyDesk

• Check all Linux systems for AnyDesk version 8.0.2 and upgrade to 8.0.3 or newer immediately.
• Verify that TCP port 7070 is not exposed to untrusted networks or the public internet.
• Monitor system logs for unusual AnyDesk service activity or unexpected root-level command executions.
• Review firewall rules to restrict remote desktop access to trusted IP addresses only.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of AnyDesk are affected by the AnyPwn vulnerability?

The vulnerability affects AnyDesk Linux version 8.0.2. It was fixed in version 8.0.3, which was released in June.

Does exploiting this flaw require user interaction or authentication?

No, the flaw allows for zero-click, pre-authentication remote code execution without user approval or credentials.

How was the vulnerability discovered and disclosed?

Rick de Jager of the V12 security team discovered the flaw using the V12 platform and disclosed it publicly in June.