High · published November 6, 2025
⚡ AnyDesk users, beware! A crafty remote user with 'Control my device' permission can bypass confirmation and set a password for full access! 🔐 Think of it like giving someone a spare key to your house but forgetting to ask for it back—they can come and go as they please, and you won't even know! This vulnerability allows an attacker to seize control of the remote session without your consent. With full access, they can manipulate settings, steal sensitive data, or cause chaos in your workflow—all without you being aware until it’s too late!
Think of it like giving someone a spare key to your house but forgetting to ask for it back—they can come and go as they please, and you won't even know! In AnyDesk versions through 9.0.4, a connected user with 'Control my device' can create a Full Access profile password without counterparty confirmation, effectively enabling unauthorized access later on.
This vulnerability allows an attacker to seize control of the remote session without your consent. With full access, they can manipulate settings, steal sensitive data, or cause chaos in your workflow—all without you being aware until it’s too late! To protect yourself, ensure you upgrade AnyDesk to version 9.0.5 or later immediately. Additionally, review your permissions settings and consider limiting 'Control my device' access to trusted users only. Stay vigilant! You've got this! Secure your setup and keep your data safe! 🛡️