poslední zpráva · zachyceno
SPOJENO AI EPSS 0.02
AnyDesk Pre-auth Heap Buffer Overflow RCE
Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.8, CVEs: , Summary: AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
AnyDesk FI IT
CVE v události 1
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-109390 | 9.8 3.1 · mitre | – | 0.02 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.8.
Jak se o tom psalo 2
-
· zachyceno · NCSC-FI FI nadpis události
AnyDesk Pre-auth Heap Buffer Overflow RCE
Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.8, CVEs: , Summary: AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.
-
· CSIRT Itálie (ACN) IT
AnyDesk: disponibile PoC pubblico per la CVE-2026-109390
Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-109390 - già sanata dal vendor - presente in AnyDesk per sistemi Linux, nota soluzione per l’accesso, il supporto e il controllo remoto dei dispositivi tramite connessioni di rete. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un attaccante remoto non autenticato di eseguire codice arbitrario con privilegi elevati sui sistemi interessati.