PT-2022-12119 · Anydesk · Anydesk

Published 2022-09-12 · Updated 2022-09-16 · CVE-2021-44426

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AnyDesk versions prior to 6.2.6 AnyDesk versions 6.3.x prior to 6.3.5

Description An issue allows the upload of an arbitrary file to a victim's local ~/Downloads/ directory without approval or action taken by the victim. This occurs when the victim uses the AnyDesk Windows client to connect to a remote machine and an attacker is also connected remotely with AnyDesk to the same remote machine.

Recommendations For versions prior to 6.2.6, update to version 6.2.6 or later. For versions 6.3.x prior to 6.3.5, update to version 6.3.5 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-44426

Affected Products

Anydesk

References · 7

• 🔥 https://argus-sec.com/discovering-tunneling-service-security-flaws-in-anydesk-remote-application · Exploit
• https://safe-surf.ru/specialists/base-vulnerabilities/684362 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44426 · Security Note
• https://anydesk.com/en/downloads/windows · Vendor Advisory
• https://t.me/cibsecurity/49602 · Telegram Post
• https://t.me/cvenotify/36342 · Telegram Post