PT-2022-12118 · Anydesk · Anydesk

Published 2022-09-12 · Updated 2022-09-16 · CVE-2021-44425

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AnyDesk versions prior to 6.2.6 AnyDesk versions 6.3.x prior to 6.3.3

Description An issue was discovered in the AnyDesk software, where an unnecessarily open listening port is created on a machine in the LAN of an attacker when the tunneling feature is used by the AnyDesk Windows client. This allows the attacker unauthorized access to the local machine's AnyDesk tunneling protocol stack and any remote destination machine software listening to the AnyDesk tunneled port.

Recommendations For AnyDesk versions prior to 6.2.6, update to version 6.2.6 or later to resolve the issue. For AnyDesk versions 6.3.x prior to 6.3.3, update to version 6.3.3 or later to resolve the issue. As a temporary workaround, consider disabling the tunneling feature until a patch is available. Restrict access to the AnyDesk tunneling protocol stack to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2021-44425

Affected Products

Anydesk

References · 7

• 🔥 https://argus-sec.com/discovering-tunneling-service-security-flaws-in-anydesk-remote-application · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44425 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44425 · Vendor Advisory
• https://anydesk.com/en/downloads/windows · Vendor Advisory
• https://t.me/cvenotify/36341 · Telegram Post
• https://t.me/cibsecurity/49613 · Telegram Post
• https://github.com/advisories/GHSA-rgr5-hjh7-p6gp · Note