PT-2026-23463 · Unknown · Rustdesk Client

Erez Kalman · Published 2026-03-05 · Updated 2026-03-10 · CVE-2026-30798

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description A flaw exists in RustDesk Client related to insufficient verification of data authenticity and improper handling of exceptional conditions, specifically allowing protocol manipulation. The issue resides within the heartbeat sync loop and strategy processing modules, impacting program files src/hbbs http/sync.Rs and the stop-service handler routine in the heartbeat loop. This allows for the acceptance of unauthenticated stop-service commands via a strategy payload.

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Fix

Improper Handling of Exceptional Conditions

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-755

CWE-345

Related Identifiers

CVE-2026-30798

Affected Products

Rustdesk Client

References · 9

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://osv.dev/vulnerability/CVE-2026-30798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30798 · Security Note
• https://t.me/CVEtracker/46459 · Telegram Post
• https://vulsec.org · Note
• https://twitter.com/CVEnew/status/2029654732202029327 · Twitter Post
• https://twitter.com/cyberbivash/status/2029617585084362871 · Twitter Post
• https://rustdesk.com/docs/en/client · Note
• https://t.me/cveNotify/154975 · Telegram Post