Working exploit published for pre-auth AnyDesk Linux root flaw
Researchers released code for an unauthenticated remote code execution bug in AnyDesk Linux that grants root access, though a patch is available.
Key points
- A working exploit for a pre-authentication RCE in AnyDesk Linux has been published.
- The vulnerability allows attackers to gain root access without user approval.
- AnyDesk addressed the issue in version 8.0.3, but no CVE was assigned.
Security researchers have published a fully functional exploit for a pre-authentication remote code execution vulnerability in the Linux version of AnyDesk, according to a report by The Hacker News. This flaw allows attackers to execute arbitrary code and gain root-level access to a system before any connection is approved by the user.
The publication of this exploit highlights the severity of the underlying issue, which permits unauthorized remote code execution without requiring authentication. Attackers can leverage this to take complete control of affected Linux machines, bypassing the standard session approval workflow that typically protects users from unwanted access. The availability of working exploit code significantly lowers the barrier for malicious actors to target vulnerable installations.
Patch status and disclosure details
AnyDesk released a fix for this vulnerability in version 8.0.3 in June. However, the vendor’s changelog for that update described the resolution vaguely as fixing "a bug that could lead to a crash," according to The Hacker News. The update did not include a Common Vulnerabilities and Exposures (CVE) identifier, nor did it explicitly label the fix as a security remediation. This lack of transparency in the release notes may have led some administrators to overlook the critical nature of the update, potentially leaving systems exposed until the exploit was publicly shared.
Impact on users
The vulnerability affects users running Linux versions of AnyDesk prior to 8.0.3. Because the flaw is pre-authentication, it does not require the victim to accept a connection request, making it particularly dangerous for systems exposed to the internet or within networks where AnyDesk is widely deployed. The ability to gain root access means an attacker can install malware, steal data, or pivot to other systems within the network environment.
What should you do?
Organizations and individual users should immediately verify their AnyDesk version on all Linux endpoints. If the installed version is older than 8.0.3, users should update to the latest available release to mitigate the risk of exploitation. Administrators should also review their network logs for any unusual outbound connections or unauthorized access attempts that may indicate prior exploitation.
What to do and how to stay safe: AnyDesk
- Audit all Linux systems to identify any installations of AnyDesk running versions older than 8.0.3.
- Update affected AnyDesk installations to the latest version immediately to apply the vendor's fix.
- Monitor system logs and network traffic for signs of unauthorized remote access or suspicious activity.
- Restrict inbound connections to AnyDesk services to trusted IP addresses where possible to reduce exposure.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a CVE for the AnyDesk Linux vulnerability?
No, AnyDesk did not assign a CVE to the flaw fixed in version 8.0.3.
When was the patch for this vulnerability released?
AnyDesk released the patch in version 8.0.3 in June.
Does the exploit require user interaction?
No, the exploit works before anyone approves the connection, allowing unauthenticated access.
