Betterdesk
Monthly
Device identity replay in UNITRONIX BetterDesk through version 2.3.0 permits unauthenticated clients to resurrect soft-deleted peer registrations by presenting a known deleted device ID, bypassing administrator-enforced device exclusion controls. The root cause is an implicit SQL upsert that cleared soft-deletion flags on any conflicting registration insert, meaning deletion was not enforced at the database layer. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CVSS AC:H reflects the non-trivial but realistic prerequisite of possessing a previously issued device identifier.
Device identity replay in UNITRONIX BetterDesk through version 2.3.0 permits unauthenticated clients to resurrect soft-deleted peer registrations by presenting a known deleted device ID, bypassing administrator-enforced device exclusion controls. The root cause is an implicit SQL upsert that cleared soft-deletion flags on any conflicting registration insert, meaning deletion was not enforced at the database layer. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CVSS AC:H reflects the non-trivial but realistic prerequisite of possessing a previously issued device identifier.