CVE-2025-27917

Executive Summary

CVE-2025-27917 is a critical Denial of Service (DoS) vulnerability affecting multiple AnyDesk remote desktop clients across Windows, macOS, Linux, iOS, and Android platforms. The flaw resides in the deserialization process of network packets, where improper handling of crafted serialized data leads to failed memory allocation and a subsequent NULL pointer dereference. An unauthenticated, remote attacker can exploit this by sending a specially crafted packet to an AnyDesk client, causing the application to crash and resulting in a denial of service. The vulnerability has a CVSS score of 7.5 (High) due to its network-based, low-complexity attack vector with no required privileges or user interaction. No public proof-of-concept (PoC) code or exploit is currently available, but the risk is elevated given the widespread use of AnyDesk for remote support and administration.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a binary application vulnerability. The supply chain risk is moderate, as the vulnerable binaries are distributed directly by AnyDesk. Organizations should verify the integrity of downloaded installers via checksums provided by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service.

Threat Level: High. The vulnerability is trivial to exploit remotely, requires no authentication, and directly crashes the application. While no public exploit exists, the low complexity makes it a prime target for weaponization.

Deep Dive & Mechanics

The vulnerability is rooted in the deserialization of network packets within AnyDesk’s proprietary protocol. When an AnyDesk client receives a packet, it deserializes the data to reconstruct objects in memory. The flaw occurs when a specially crafted packet contains malformed or oversized serialized data that triggers a failed memory allocation (e.g., malloc returns NULL). The code then attempts to dereference this NULL pointer, leading to an immediate application crash (segmentation fault).

Technical Flow:

1. An attacker sends a crafted UDP or TCP packet to the AnyDesk client’s listening port (default 7070).
2. The client’s packet handler invokes a deserialization routine.
3. The routine attempts to allocate memory for the deserialized object based on attacker-controlled size fields.
4. The allocation fails (e.g., due to an impossibly large size), returning NULL.
5. The code does not check the return value and proceeds to dereference the NULL pointer.
6. The application crashes, denying service to the legitimate user.

The vulnerability is present in all major platforms due to shared code in the core deserialization library. The fix involves adding proper NULL checks after memory allocation and validating allocation sizes before proceeding.

Vulnerable vs. Patched Code

Vulnerable Code (C++ pseudocode):

void DeserializePacket(Packet* pkt) {
    int size = pkt->ReadInt();
    char* data = (char*)malloc(size);  // No size validation
    pkt->ReadBytes(data, size);        // NULL dereference if malloc fails
    // ... process data
}

Patched Code (C++ pseudocode):

void DeserializePacket(Packet* pkt) {
    int size = pkt->ReadInt();
    if (size <= 0 || size > MAX_PACKET_SIZE) {
        // Reject invalid size
        return;
    }
    char* data = (char*)malloc(size);
    if (data == NULL) {
        // Handle allocation failure
        return;
    }
    pkt->ReadBytes(data, size);
    // ... process data
    free(data);
}

The patch adds two critical checks: a size validation to prevent unreasonable allocation requests, and a NULL pointer check after malloc to safely abort processing if allocation fails.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• AnyDesk client running a vulnerable version (e.g., Windows 9.0.4).
• Network access to the target client (port 7070 UDP/TCP).
• A tool to craft raw packets (e.g., Scapy, Python with sockets).

Exploitation Steps:

1. Identify the target AnyDesk client IP and ensure port 7070 is open.
2. Craft a malicious packet with a deserialization payload that specifies an extremely large size field (e.g., 0xFFFFFFFF).
3. Send the packet to the target.
4. The client will attempt to allocate memory, fail, and crash.

Example Python Script (Conceptual):

import socket

target_ip = "192.168.1.100"
target_port = 7070

# Craft a malicious packet (simplified)
# The exact binary format would require reverse engineering the protocol
payload = b"\x00" * 4  # Placeholder for header
payload += b"\xff\xff\xff\xff"  # Large size field (4 bytes)
payload += b"A" * 100  # Dummy data

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (target_ip, target_port))
sock.close()

Note: No public exploit code is available. The above is a conceptual example. Actual exploitation requires understanding of AnyDesk’s proprietary protocol.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusually large packets destined for port 7070.
• Alert on repeated connection attempts from a single IP to multiple AnyDesk clients.
• Use the YARA and Sigma rules provided below.

Defense:

• Immediately update AnyDesk to the patched versions.
• Restrict inbound access to port 7070 using a firewall to trusted IPs only.
• Deploy network intrusion detection systems (NIDS) with Suricata rules.
• Enable application whitelisting to prevent unauthorized AnyDesk installations.

Indicators of Compromise (IOCs)

• Network IOCs:
  • UDP/TCP packets to port 7070 with abnormally large payload sizes (> 65535 bytes).
  • Repeated connection attempts from a single external IP to multiple internal AnyDesk clients.
• Host IOCs:
  • AnyDesk process (AnyDesk.exe, AnyDesk, AnyDesk.app) crashing unexpectedly.
  • Event logs showing application crash with error code 0xC0000005 (Access Violation).
  • Memory dump files in the AnyDesk installation directory.
• File IOCs:
  • AnyDesk binary versions:
    • Windows: < 9.0.5 (e.g., 9.0.4)
    • macOS: < 9.0.1
    • Linux: < 7.0.0
    • iOS: < 7.1.2
    • Android: < 8.0.0

Detection Engineering

YARA Rule

rule CVE_2025_27917_AnyDesk_DoS {
    meta:
        description = "Detects AnyDesk binaries vulnerable to CVE-2025-27917"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:example"
    strings:
        $vuln_func = { 8B 45 08 89 04 24 E8 ?? ?? ?? ?? 89 45 FC 83 7D FC 00 }  // malloc without NULL check
        $patched_func = { 83 7D 08 00 7E 1A 81 7D 08 00 00 10 00 7F 10 }  // size validation
    condition:
        $vuln_func and not $patched_func
}

Sigma Rule

title: AnyDesk DoS Exploitation Attempt (CVE-2025-27917)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic targeting AnyDesk with abnormally large packets
author: Valters IT
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 7070
        Protocol: "UDP"
        PacketSize: > 65535
    condition: selection
falsepositives:
    - Legitimate large file transfers over AnyDesk (rare)
level: high

Suricata Rule

alert udp any any -> any 7070 (msg:"CVE-2025-27917 AnyDesk DoS Attempt"; dsize:>65535; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade AnyDesk to the latest patched version:
   • Windows: 9.0.5 or later
   • macOS: 9.0.1 or later
   • Linux: 7.0.0 or later
   • iOS: 7.1.2 or later
   • Android: 8.0.0 or later
2. Network Segmentation: Restrict inbound access to port 7070 using firewall rules. Only allow connections from trusted IP ranges.
3. Monitoring: Deploy the provided Suricata and Sigma rules to detect exploitation attempts.

Long-Term Mitigations:

• Implement application whitelisting to control which AnyDesk versions are allowed.
• Regularly audit remote access tools and ensure they are updated.
• Use a Web Application Firewall (WAF) or NIDS to inspect traffic for anomalous patterns.
• Educate users to report unexpected crashes of AnyDesk.

Workarounds (if patching is delayed):

• Disable the AnyDesk service when not in use.
• Use an alternative remote desktop solution temporarily.
• Enable Windows Defender Exploit Guard or similar host-based protections.

Valters IT