PT-2026-23466 · Unknown · Rustdesk Client

Erez Kalman · Publicado 2026-03-05 · Atualizado 2026-03-05 · CVE-2026-30785

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description The RustDesk Client software contains issues related to improperly controlled modification of object prototype attributes ('Prototype Pollution') and the use of a password hash with insufficient computational effort. These issues potentially allow for the retrieval of embedded sensitive data. The problems are associated with program files including hbb common/src/password security.Rs, hbb common/src/config.Rs, hbb common/src/lib.Rs (specifically the get uuid routine), and machine-uid/src/lib.Rs. The affected program routines include symmetric crypt(), encrypt str or original(), decrypt str or original(), and get machine id().

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-257

CWE-916

CWE-323

CWE-1321

Identificadores relacionados

CVE-2026-30785

Produtos afetados

Rustdesk Client

Referências · 7

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://github.com/rustdesk/rustdesk/discussions/9229 · Nota
• https://github.com/rustdesk/rustdesk/discussions/4979 · Nota
• https://twitter.com/CVEnew/status/2029654727122690228 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30785 · Nota de Segurança
• https://vulsec.org · Nota
• https://twitter.com/VulmonFeeds/status/2029628165597888773 · Publicação no Twitter