PT-2026-23460 · Unknown · Rustdesk Client

Erez Kalman · Publicado 2026-03-05 · Atualizado 2026-03-05 · CVE-2026-30795

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description A cleartext transmission of sensitive information issue exists in RustDesk Client on Windows, MacOS, Linux, iOS, and Android, specifically within the Heartbeat sync loop modules. This allows for potential sniffing attacks. The issue is related to the construction of Heartbeat JSON payloads, including preset address book passwords, within the src/hbbs http/sync.Rs file and the Heartbeat routine.

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2026-30795

Produtos afetados

Rustdesk Client

Referências · 7

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://github.com/rustdesk/rustdesk · Nota
• https://vulsec.org · Nota
• https://osv.dev/vulnerability/CVE-2026-30795 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30795 · Nota de Segurança
• https://twitter.com/CVEnew/status/2029654737910370624 · Publicação no Twitter
• https://t.me/CVEtracker/46454 · Publicação no Telegram