CVE-2026-30783: 
NixOS vulnerability analysis and mitigation

CVE-2026-30783 is a privilege abuse vulnerability in the RustDesk Client affecting its client signaling, API sync loop, and configuration management modules. It impacts RustDesk Client versions through 1.4.5 across Windows, macOS, Linux, iOS, Android, and WebClient platforms. The vulnerability was published on March 5, 2026, and is associated with source files src/rendezvous_mediator.rs and src/hbbs_http/sync.rs. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.8 (High) (Feedly, ENISA EUVD).

The vulnerability is classified under CWE-602 (Client-Side Enforcement of Server-Side Security) and CWE-841 (Improper Enforcement of Behavioral Workflow), indicating that security controls are improperly enforced on the client side rather than the server (Feedly). An unauthenticated network attacker can abuse the client's privilege mechanisms by manipulating the API sync loop or config management routines — for example, by supplying crafted configuration values or URI schemes such as rustdesk://password/<PWD> and rustdesk://config/ to alter client behavior (PoC Document). The attack requires no privileges and no user interaction, and the config exfiltration technique leverages a Base64→Reversed String encoding scheme, with sensitive values such as preset-address-book-password stored in plaintext JSON (PoC Document). Additionally, the client can be instructed to accept invalid TLS certificates (danger_accept_invalid_certs(true)) and can be stopped via a stop-service: "Y" command, enabling further abuse (PoC Document).

Successful exploitation allows an unauthenticated remote attacker to abuse client privilege mechanisms, resulting in high integrity impact (unauthorized modification of system configuration or behavior), high availability impact (service disruption via stop-service commands), and potential credential/configuration exposure (Feedly). An attacker could exfiltrate sensitive configuration data including address book passwords, redirect the client to a malicious API server by disabling certificate validation, and orphan the API channel to cause the client to ignore all administrator commands and ACL policies (PoC Document, Infinitsec). This effectively allows an attacker to take over remote desktop sessions managed by RustDesk, with potential for lateral movement across all platforms where the client is deployed.

A public proof-of-concept exploit document was released and contains detailed reproduction steps, specific payloads, parameter names, and URI schemes sufficient to reproduce the vulnerability without additional research (PoC Document). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog (Feedly). The EPSS score is approximately 0.071% (0.000710), indicating a currently low but non-negligible probability of exploitation in the near term (Feedly). No specific threat actor attribution has been reported.

1. Reconnaissance: Identify RustDesk Client deployments (version ≤ 1.4.5) on target networks using network scanning or by identifying exposed RustDesk relay/rendezvous endpoints.
2. Craft malicious API server: Stand up a rogue API server that mimics the RustDesk API sync endpoint (hbbs_http/sync) to serve malicious configuration responses.
3. Redirect client via URI scheme: Deliver a crafted rustdesk://config/ URI to the target client (e.g., via phishing, malicious web page, or local access) to point the client at the attacker-controlled API server.
4. Disable certificate validation: Exploit the danger_accept_invalid_certs(true) retry behavior so the client accepts the attacker's self-signed TLS certificate, enabling a man-in-the-middle position on the API sync channel.
5. Inject malicious configuration: Push configuration values through the API sync loop, including stop-service: "Y" to disable the legitimate service, or inject preset-address-book-password in plaintext JSON to harvest credentials.
6. Exfiltrate configuration data: Use the Base64→Reversed String encoding scheme to extract sensitive configuration values from the client without triggering standard detection.
7. Orphan the API channel: Manipulate the rendezvous mediator (rendezvous_mediator.rs) to cause the client to ignore all administrator commands and ACL policies, effectively taking full control of the RustDesk client session (PoC Document, Infinitsec).

• Network: Outbound connections from RustDesk client processes to unexpected or unknown API server IP addresses/domains; TLS connections to API endpoints using self-signed or invalid certificates; unusual DNS queries for non-official RustDesk relay/rendezvous servers.
• Logs: RustDesk client logs showing API sync responses from non-official servers; log entries indicating danger_accept_invalid_certs retry behavior; repeated stop-service commands received from the API sync channel.
• File System: RustDesk configuration files containing preset-address-book-password in plaintext JSON; configuration files modified with unexpected API server addresses; Base64-encoded or reversed-string encoded configuration blobs in unexpected locations.
• Process: RustDesk client process terminating unexpectedly following receipt of stop-service: "Y" commands; RustDesk client ignoring administrator ACL commands or failing to respond to management console directives.
• URI/Application: Invocation of rustdesk://password/<PWD> or rustdesk://config/ URI schemes from unexpected sources (browser, email client, or script) (PoC Document).

Update RustDesk Client to a version later than 1.4.5, as all versions through 1.4.5 are affected (Feedly, ENISA EUVD). As interim workarounds: implement network segmentation to restrict RustDesk client access to only trusted API and relay servers; review and restrict API server configuration handling permissions; and monitor for suspicious RustDesk client API sync operations. Given that a public proof-of-concept is available, immediate patching is strongly recommended (Feedly).

A technical blog post from Infinitsec highlighted the ability of the vulnerability to orphan the RustDesk API channel, allowing the client to ignore all admin commands and ACL policies (Infinitsec). The CVE was noted on Bluesky by automated CVE tracking accounts shortly after publication (Bluesky). The vulnerability was assigned by VULSec and indexed by ENISA's EUVD (ENISA EUVD).