rustdesk records

12 published records for vendor rustdesk.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

12 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-25140No exploit	A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanrustdesk · rustdesk · CWE-295 Pre-auth Weak crypto	Critical9.8	—	0.5%	Feb 6, 2024
37Monitor	CVE-2026-30797No exploit	RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Serverrustdesk · rustdesk · CWE-749 Pre-auth	Critical9.3	—	0.6%	Mar 5, 2026
37Monitor	CVE-2026-30793No exploit	RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmationrustdesk · rustdesk · CWE-285 Pre-auth Broken access control (IDOR) CSRF	Critical9.3	—	0.3%	Mar 5, 2026
34Monitor	CVE-2026-30791No exploit	RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validationrustdesk · rustdesk · CWE-327 Pre-auth Weak crypto	High8.7	—	0.3%	Mar 5, 2026
34Monitor	CVE-2026-3598No exploit	RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryptionrustdesk · rustdesk server · CWE-327 Pre-auth Weak crypto	High8.7	—	0.3%	Mar 5, 2026
34Monitor	CVE-2026-30795No exploit	RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failurerustdesk · rustdesk · CWE-319 Pre-auth Weak crypto	High8.7	—	0.3%	Mar 5, 2026
33Monitor	CVE-2026-30792No exploit	RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settingsrustdesk · rustdesk · CWE-345 Pre-auth	High8.3	—	0.3%	Mar 5, 2026
32Monitor	CVE-2026-30798No exploit	RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payloadrustdesk · rustdesk · CWE-345 Pre-auth	High8.2	—	0.3%	Mar 5, 2026
32Monitor	CVE-2026-30785No exploit	RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)rustdesk · rustdesk · CWE-257 Prototype pollution	High8.2	—	0.1%	Mar 5, 2026
27Monitor	CVE-2026-30796No exploit	RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Syncrustdesk · rustdesk server · CWE-522 Pre-auth Info leak	Medium6.9	—	0.5%	Mar 5, 2026
22Monitor	CVE-2026-30789No exploit	RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Forcerustdesk · rustdesk · CWE-916	Medium5.7	—	0.3%	Mar 5, 2026
19Monitor	CVE-2026-30783No exploit	RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policiesrustdesk · rustdesk · CWE-602 Local privilege escalation	Medium4.8	—	0.5%	Mar 5, 2026

CVE-2024-25140
39Monitor
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhan
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Weak crypto
rustdesk · rustdeskFeb 6, 2024
CVE-2026-30797
37Monitor
RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
rustdesk · rustdeskMar 5, 2026
CVE-2026-30793
37Monitor
RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
CriticalCVSS 9.3No exploitEPSS 0%
rustdesk · rustdeskMar 5, 2026
CVE-2026-30791
34Monitor
RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
rustdesk · rustdeskMar 5, 2026
CVE-2026-3598
34Monitor
RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
rustdesk · rustdesk serverMar 5, 2026
CVE-2026-30795
34Monitor
RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
rustdesk · rustdeskMar 5, 2026
CVE-2026-30792
33Monitor
RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
rustdesk · rustdeskMar 5, 2026
CVE-2026-30798
32Monitor
RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
rustdesk · rustdeskMar 5, 2026
CVE-2026-30785
32Monitor
RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)
HighCVSS 8.2No exploitEPSS 0%
- Prototype pollution
rustdesk · rustdeskMar 5, 2026
CVE-2026-30796
27Monitor
RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Info leak
rustdesk · rustdesk serverMar 5, 2026
CVE-2026-30789
22Monitor
RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force
MediumCVSS 5.7No exploitEPSS 0%
rustdesk · rustdeskMar 5, 2026
CVE-2026-30783
19Monitor
RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies
MediumCVSS 4.8No exploitEPSS 0%
- Local privilege escalation
rustdesk · rustdeskMar 5, 2026