Advisories · Technology
rustdesk-client RustDesk Client.
Every CVE that names rustdesk-client RustDesk Client among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)
- rustdesk-client RustDesk Client
- Weak cryptography or TLS
- Prototype pollution
- CVSS 4.8 Medium
RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies
- rustdesk-client RustDesk Client
- CWE-602
- CWE-841
- CVSS 5.7 Medium
RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force
- rustdesk-client RustDesk Client
- Weak cryptography or TLS
- CVSS 8.2 High
RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload
- rustdesk-client RustDesk Client
- CWE-345
- CWE-755
- CVSS 9.3 CriticalCritical · CVSS 9+
RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server
- rustdesk-client RustDesk Client
- Broken access control
- CWE-749
- CVSS 6.9 Medium
RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync
- rustdesk-client RustDesk Client
- Hard-coded credentials
- CVSS 8.7 High
RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
- rustdesk-client RustDesk Client
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
- rustdesk-client RustDesk Client
- Broken access control
- Cross-site request forgery (CSRF)
- CVSS 8.3 High
RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings
- rustdesk-client RustDesk Client
- CWE-345
- CVSS 8.7 High
RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
- rustdesk-client RustDesk Client
- Weak cryptography or TLS
- CWE-684