CVE-2024-52940 Information disclosure in n/a
An attacker knowing the victim's ID can expose their public IP address if direct connections are enabled, requiring configuration changes to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-52940?
CVE-2024-52940 is a high-severity vulnerability in n/a, published on 18 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID.
Weakness: CWE-532
Which versions are affected by CVE-2024-52940?
How do I fix CVE-2024-52940?
No fix has been published for CVE-2024-52940 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-52940 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52940 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-r2ph-vgmf-8gqh.