CVE-2026-30791
RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
Summary
RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
Original description
The description as published by the source.
Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files flutter/lib/common.Dart, hbb_common/src/config.Rs and program routines parseRustdeskUri(), importConfig().
This issue affects RustDesk Client: through 1.4.5.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory vulsec.org
- package github.com
- report docs.google.com
- web github.com
- web rustdesk.com