Rustdesk
CVE-2026-30794
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe) · only source for this CVE.
CVSS VectorVendor: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Lifecycle Timeline
2DescriptionCVE.org
Improper Certificate Validation vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (HTTP API client, TLS transport modules) allows Adversary in the Middle (AiTM). This vulnerability is associated with program files src/hbbs_http/http_client.Rs and program routines TLS retry with danger_accept_invalid_certs(true).
This issue affects RustDesk Client: through 1.4.5.
AnalysisAI
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
Technical ContextAI
RustDesk is an open-source remote desktop alternative. Multiple vulnerability classes across client and server.
RemediationAI
Update RustDesk.
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Au
Remote denial-of-service in RustDesk Client through 1.4.5 allows network-positioned attackers to disrupt the remote-acce
Authorization scope bypass in RustDesk lets a peer holding only a FileTransfer authorization inject keyboard and mouse i
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remot
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remot
Unauthenticated attackers can abuse missing authorization controls in RustDesk Server's rendezvous and relay modules (hb
Memory exhaustion in RustDesk versions before 1.4.7 allows unauthenticated remote attackers to crash or severely degrade
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat
RustDesk Server Pro through version 1.7.5 uses weak cryptographic algorithms in configuration string generation and web
Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote
Configuration tampering in RustDesk Client through 1.4.5 allows a network-positioned attacker to manipulate Application
Password brute-forcing weakness in RustDesk Server Pro through 1.7.5 and RustDesk Server (OSS) through 1.1.15 allows rem
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today