RustDesk Client CVE-2026-30792

Attacker must hold an active man-in-the-middle position on the HTTP API channel that the RustDesk Client uses to fetch its server-side Strategy and option set - concretely, the ability to modify responses returned to src/hbbs_http/sync.rs during the Strategy merge loop that feeds Config::set_options(). No user interaction or authentication is required on the client side (CVSS PR:N/UI:N), but exploitation is gated by the AT:P attack requirement: the attacker needs network-path control between the client and its sync server, which limits the scenario to hostile local networks, compromised upstream infrastructure, or attacker-operated/poisoned self-hosted RustDesk servers. Clients that never reach a strategy-pushing server, or whose traffic is wrapped in an integrity-verified channel the attacker cannot tamper with, are not exploitable.

Signals are mixed: the vendor-style CVSS 4.0 vector scores 8.3 with AV:N/AC:L/PR:N/UI:N and high integrity impact (VI:H), but the AT:P attack-requirement metric correctly reflects that exploitation requires an attacker-in-the-middle position on the network path between client and server - not a precondition that is satisfied against arbitrary internet users. EPSS is only 0.05% (16th percentile) and the issue is not on CISA KEV, indicating no detected mass exploitation, and no public exploit identified at time of analysis. Realistically this is a meaningful integrity risk for organizations relying on RustDesk's self-hosted strategy/config push - particularly where client-server traffic traverses untrusted networks or terminates TLS at intermediaries - but it is not a drop-everything zero-day. The CVSS 4.0 confidentiality impact (VC:L) plus the 'Information Disclosure' tag suggests some option values may leak, which should be confirmed against the vendor advisory once published.

An attacker in a privileged network position (rogue Wi-Fi, ISP/router compromise, TLS-stripping proxy, or a self-hosted RustDesk server fronted by an attacker-controlled load balancer) intercepts the periodic strategy/config sync between a RustDesk client and its server and rewrites the response JSON. The crafted payload is merged by sync.rs's Strategy merge loop and applied through Config::set_options(), flipping options such as relay address, permission flags, or other advanced settings to redirect the client or relax its security posture. No public exploit identified at time of analysis.