Rustdesk Api
Monthly
Unauthenticated peer-record tampering in the RustDesk API server (lejianwen/rustdesk-api) through version 2.7 lets any remote attacker who can reach the HTTP API overwrite an existing peer's stored hostname, username, OS and uuid by posting only a target device ID to POST /api/sysinfo, after which the attacker can log in with the forged uuid and rebind that peer to their own account. The root cause is an authorization bypass through a user-controlled key (CWE-639): the endpoint never verifies that the submitted uuid belongs to the peer record it is modifying. The independent assessment scores this as remote, low-complexity, unauthenticated and requiring no user interaction but with integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, versus the submitted CVSS 4.0 score of 6.9), and the single prerequisite is that the attacker must know or enumerate a valid existing device ID; no public exploit code and no CISA KEV entry were identified at time of analysis, although a detailed public technical write-up is available.
Unauthenticated peer-record tampering in the RustDesk API server (lejianwen/rustdesk-api) through version 2.7 lets any remote attacker who can reach the HTTP API overwrite an existing peer's stored hostname, username, OS and uuid by posting only a target device ID to POST /api/sysinfo, after which the attacker can log in with the forged uuid and rebind that peer to their own account. The root cause is an authorization bypass through a user-controlled key (CWE-639): the endpoint never verifies that the submitted uuid belongs to the peer record it is modifying. The independent assessment scores this as remote, low-complexity, unauthenticated and requiring no user interaction but with integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, versus the submitted CVSS 4.0 score of 6.9), and the single prerequisite is that the attacker must know or enumerate a valid existing device ID; no public exploit code and no CISA KEV entry were identified at time of analysis, although a detailed public technical write-up is available.