RustDesk API CVE-2026-111324

The POST /api/sysinfo endpoint performs no uuid ownership verification, so no special product configuration is required on a default, network-reachable rustdesk-api instance (version ≤ 2.7). The one concrete prerequisite is that the attacker must know or enumerate a valid existing target device ID to overwrite that peer's record; the full account-rebind outcome additionally requires the attacker to complete a login step presenting the forged uuid. Limiting factors: exploitation only matters for internet- or network-exposed API deployments and requires a valid target peer ID, but no authentication, credentials, or user interaction are needed.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores strong exploitability - remote, network-reachable, low complexity, no privileges and no user interaction - meaning any unauthenticated attacker who can reach the web API can trigger it. However, the impact metrics are deliberately narrow: VI:L (low integrity) with VC:N and VA:N, yielding the moderate 6.9 score, because the primary effect is tampering with stored peer records rather than direct data disclosure or service loss. This is the central tension: the ease-of-attack signals look critical while the rated impact is modest. Note that the rated VI:L understates the described kill chain - overwriting a victim device's uuid and then logging in to rebind that peer to the attacker's account can yield unauthorized control/visibility of the targeted remote-access endpoint, an escalation not captured in the base impact metrics; verify downstream account-takeover severity with the vendor advisory. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified. It is not listed in CISA KEV (no active exploitation confirmed), but a detailed public technical write-up with source-code references exists. Net: a credible, easy-to-exploit authorization-bypass (IDOR, CWE-639) worth prompt patching for exposed self-hosted instances, but not an emergency on raw signals absent KEV/EPSS data.

An attacker who can reach an internet-exposed rustdesk-api server sends an unauthenticated POST to /api/sysinfo supplying only a known target device ID, overwriting that peer's hostname, username, OS and uuid. The attacker then logs in presenting the forged uuid, rebinding the victim's peer record to their own account to gain unauthorized association with the targeted device. A public technical write-up documenting the request exists, so publicly available exploit code exists.