Security readout for executives and security teams
Plain-English summary
RustDesk Client through 1.4.8 can expose a login proof on the Server Pro /api management path if TLS is downgraded because of invalid certificates. An attacker who captures it may try offline password guessing. The normal controlled-host peer authentication channel is stated as not affected.
Executive priority
Treat as high priority if RustDesk Server Pro /api is reachable or certificate handling is weak. The business risk is credential compromise through captured login proofs and offline guessing, not direct system takeover from the CVE alone.
Technical view
The issue combines cleartext exposure on the Server Pro /api login path under automatic invalid-certificate downgrade with a fast double-SHA256 login proof using server-controlled salt and challenge. CWE mappings are CWE-319 and CWE-916. CVSS 4.0 score is 8.2 high.
Likely exposure
Organizations using RustDesk Client through 1.4.8 on Windows, macOS, Linux, iOS, or Android with Server Pro /api login are the stated exposure. Risk is higher where the management/API channel can be intercepted or uses invalid TLS that triggers downgrade.
Exploitation context
The source bundle does not show KEV listing or confirmed active exploitation. Exploitation requires interception of the affected /api login traffic under downgrade conditions, followed by offline password brute forcing. The peer authentication channel is explicitly described as not affected.
Researcher notes
Relevant routines are handle_hash(), handle_login_from_ui(), and post_request_() in src/client.rs and src/common.rs. The CVE text withdraws capture-replay concerns for peer authentication. Evidence for a patch is not present in the provided sources.
Mitigation direction
- Check RustDesk vendor guidance and advisories for fixed versions or configuration changes.
- Ensure Server Pro /api uses valid TLS certificates; avoid any HTTP or downgraded management path.
- Restrict network access to RustDesk management/API endpoints to trusted administrative networks.
- Rotate affected credentials if downgraded or intercepted login traffic is suspected.
- Monitor for related guidance on CVE-2026-30794, the TLS downgrade issue.
Validation and detection
- Inventory RustDesk Client installations and identify versions through 1.4.8.
- Determine whether Server Pro /api login is used in your environment.
- Verify management/API endpoints use valid certificates and do not fall back to HTTP.
- Confirm the controlled-host peer channel is not your assumed exposure path.
- Review vendor and CVE records for updates, patches, or clarified affected versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-319: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-916: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-30790 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——VULSecVulnerability scoring details
Base CVSS 4.0 score
8.2HighVector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/rustdeskCVE reference, VULSec · product
- https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pubCVE reference, VULSec · third-party-advisory, exploit
- https://www.vulsec.org/CVE reference, VULSec · vdb-entry, third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Use of Password Hash With Insufficient Computational Effort
Use of Password Hash With Insufficient Computational Effort represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.