PT-2026-23461 · Unknown · Rustdesk Server Pro

Erez Kalman · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-30796

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustDesk Server Pro versions through 1.7.5

Description A security issue exists in RustDesk Server Pro related to the transmission of sensitive information in cleartext. The vulnerability is present in the address book sync API modules and allows for potential sniffing attacks. Specifically, the Heartbeat API handler (heartbeatApiHandler()) accepts the preset-address-book-password parameter in plaintext, exposing it during transmission. This affects the heartbeat sync functionality.

Recommendations Versions prior to 1.7.6 should be updated.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2026-30796

Affected Products

Rustdesk Server Pro

References · 7

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://rustdesk.com/docs/en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30796 · Security Note
• https://vulsec.org · Note
• https://twitter.com/cyberbivash/status/2029617592348869007 · Twitter Post
• https://t.me/CVEtracker/46455 · Telegram Post
• https://twitter.com/CVEnew/status/2029654736920629317 · Twitter Post