PT-2026-23458 · Unknown · Rustdesk Client

Erez Kalman · Publicado 2026-03-05 · Atualizado 2026-03-05 · CVE-2026-30793

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description A Cross-Site Request Forgery (CSRF) issue exists in RustDesk Client on Windows, MacOS, Linux, iOS, and Android. This flaw potentially allows for privilege escalation. The issue is related to the Flutter URI scheme handler and FFI bridge modules, specifically within the files flutter/lib/common.Dart and src/flutter ffi.Rs, and the routines URI handler for rustdesk://password() and bind.MainSetPermanentPassword().

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Correção

LPE

Improper Authorization

CSRF

Enumeração de Fraquezas

CWE-285

CWE-352

Identificadores relacionados

CVE-2026-30793

Produtos afetados

Rustdesk Client

Referências · 8

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://github.com/rustdesk/rustdesk · Nota
• https://github.com/rustdesk/hbb_common · Nota
• https://vulsec.org · Nota
• https://t.me/CVEtracker/46452 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-30793 · Nota de Segurança
• https://twitter.com/CVEnew/status/2029654739915325688 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30793 · Aviso do Fabricante