Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: rustdesk-client Component: Rustdesk Clear all filters
TI-2026-23621 CVE-2026-30785 · GHSA-v738-924g-mm67

RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)

Priority HIGH 77

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common…

CVSS 4.0HIGH 8.2 Local Low privileges No interaction EPSS 0.00095 Published 2026-03-05 No fix listed CWE-1321
TI-2026-23622 CVE-2026-30789 · GHSA-9qf7-q6gx-q652

RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force

Priority HIGH 67

Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Andro…

CVSS 4.0MEDIUM 5.7 Local Low privileges No interaction EPSS 0.00315 Published 2026-03-05 No fix listed CWE-916
TI-2026-23629 CVE-2026-30798 · GHSA-w793-gh7r-h7mx

RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload

Priority HIGH 75

Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, st…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00337 Published 2026-03-05 No fix listed CWE-345
TI-2026-23628 CVE-2026-30797 · GHSA-9h94-q24v-4v27

RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server

Priority HIGH 75

Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulatio…

CVSS 4.0CRITICAL 9.3 Network No auth User interaction EPSS 0.00522 Published 2026-03-05 No fix listed CWE-749
TI-2026-23625 CVE-2026-30793 · GHSA-83v8-c68x-gcpr

RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation

Priority HIGH 75

Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation.

CVSS 4.0CRITICAL 9.3 Network No auth User interaction EPSS 0.00348 Published 2026-03-05 No fix listed CWE-285
TI-2026-23624 CVE-2026-30792 · GHSA-39g5-2q66-34fm

RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings

Priority HIGH 77

A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config options engine modules) allows Application API Message Manipula…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00304 Published 2026-03-05 No fix listed CWE-345