An issue exists in AnyDesk prior to 6.2.6 and 6.3.x prior to 6.3.5. An upload of an arbitrary file to a victim's local ~/Downloads/ directory is possible if the victim is using the AnyDesk Windows client to connect to a remote machine, if an attacker is also connected remotely with AnyDesk to the same remote machine. The upload is done without any approval or action taken by the victim.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
anydesk anydesk |
Vulmon