PT-2026-23459 · Rustdesk · Rustdesk Client

Erez Kalman · Publicado 2026-03-05 · Atualizado 2026-03-05 · CVE-2026-30794

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description An improper certificate validation issue exists in the RustDesk Client, potentially allowing an Adversary in the Middle (AiTM) attack. The issue is related to the handling of TLS retries and the use of danger accept invalid certs(true) within the http client.Rs file. This affects the HTTP API client and TLS transport modules on Windows, MacOS, Linux, iOS, and Android.

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-30794

Produtos afetados

Rustdesk Client

Referências · 8

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://github.com/rustdesk/rustdesk · Nota
• https://vulsec.org · Nota
• https://osv.dev/vulnerability/CVE-2026-30794 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2029612809647013936 · Publicação no Twitter
• https://t.me/CVEtracker/46453 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-30794 · Nota de Segurança
• https://twitter.com/CVEnew/status/2029654738904531337 · Publicação no Twitter