AnyDesk Remote Settings Manipulation Vulnerability Allowing Unauthorized Password Creation for Full Access Profile

A vulnerability exists in AnyDesk versions through 9.0.4, allowing a remotely connected user with 'Control my device' permission to alter remote AnyDesk settings. The user can create a password for the Full Access profile without requiring confirmation from the other party. This enables the user to connect later without needing counterparty approval.

Impact

Exploitation of this vulnerability allows for unauthorized access to a user's device via the Full Access profile, bypassing the usual confirmation process.