CVE-2024-52940
HIGHAnyDesk <= 8.1.0 - Sensitive Information Exposure via Direct Connection Traffic
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-52940. PoCs published by ebrasha, MKultra6969.
AI-analyzed exploit summary This PoC monitors network connections for AnyDesk to detect remote IP leakage by filtering TCP/UDP connections associated with the AnyDesk process. It highlights non-standard ports (excluding 443/80) and UDP port 7070, indicating potential exposure of remote IPs.
Description
AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID.
Exploits (2)
This PoC monitors network connections for AnyDesk to detect remote IP leakage by filtering TCP/UDP connections associated with the AnyDesk process. It highlights non-standard ports (excluding 443/80) and UDP port 7070, indicating potential exposure of remote IPs.
This PoC monitors TCP connections of targeted processes (e.g., AnyDesk) on Windows, leveraging CVE-2024-52940 to log IP addresses, ports, and process details. It uses netstat and tasklist commands to gather connection data and enriches it with geolocation information from ip-api.com.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N