RustDesk Client CVE-2026-30789

Exploitation requires the attacker to first capture a genuine RustDesk authentication exchange (session ID plus the login proof derived from hash_password()) between a legitimate controller and the target peer - reflected in CVSS AC:H and AT:P. The attacker must reach the target peer over the network on RustDesk's signaling/relay ports while the captured session ID is still considered valid by the peer, and the target must be running RustDesk Client at version 1.4.5 or earlier on any supported platform (Windows, macOS, Linux, iOS, Android). No user interaction (UI:N) and no prior authentication (PR:N) on the target are required once a valid proof has been captured, but the dependency on prior traffic capture and protocol-specific preconditions meaningfully limits opportunistic exploitation compared with a default-config unauthenticated RCE.

Signals are mixed. The CVSS 4.0 score of 8.2 (High) reflects network reach (AV:N), no privileges (PR:N), and high confidentiality impact (VC:H) on the remote session, but is tempered by AC:H and AT:P - the attacker must first capture a valid session/authentication exchange and meet specific protocol preconditions, which is non-trivial. EPSS is only 0.04% (12th percentile) and the CVE is not on CISA KEV, with no public exploit identified at time of analysis, so real-world exploitation pressure today is low. Integrity and availability are rated N in the vector, yet a successful replay would let an attacker assume a peer identity - a defender should treat VI/VA as potentially understated and prioritize patching deployments where RustDesk is exposed to untrusted networks or used for privileged remote administration.

An attacker positioned to observe RustDesk authentication traffic - for example on a shared Wi-Fi network, a compromised relay, or via ARP/DNS spoofing on the same LAN as a target peer - captures the session ID and login proof exchanged when a legitimate user connects to a remote desktop. The attacker later replays the captured proof against the same peer to bypass authentication and obtain a remote-control session as the impersonated user, leveraging the predictability of hash_password() output and the absence of per-session nonce binding. No public exploit identified at time of analysis, but the attack pattern follows well-documented capture-replay tooling.