CVE-2021-44426

HIGH

AnyDesk < 6.2.6 and 6.3.x < 6.3.5 - Unauthenticated Arbitrary File Upload to Victim Downloads Directory

Title source: llm
STIX 2.1

Description

An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. An upload of an arbitrary file to a victim's local ~/Downloads/ directory is possible if the victim is using the AnyDesk Windows client to connect to a remote machine, if an attacker is also connected remotely with AnyDesk to the same remote machine. The upload is done without any approval or action taken by the victim.

References (2)

Core 2
Core References
Product, Vendor Advisory x_refsource_misc
https://anydesk.com/en/downloads/windows

Scores

CVSS v3 8.8
EPSS 0.0098
EPSS Percentile 57.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
anydesk/anydesk < 6.2.6
Published Sep 12, 2022
Tracked Since Feb 18, 2026