CVE-2026-30792: 
NixOS vulnerability analysis and mitigation

CVE-2026-30792 is a Man-in-the-Middle (MitM) vulnerability in the RustDesk Client that allows unauthenticated attackers to manipulate application API messages, altering client configuration settings and strategy parameters. It affects RustDesk Client versions through 1.4.5 across all supported platforms: Windows, macOS, Linux, iOS, Android, and WebClient. The vulnerability was published on March 5, 2026, and assigned by VULSec. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 9.1 (Critical) (Feedly, ENISA EUVD).

The root cause is classified as CWE-657 (Violation of Secure Design Principles): the RustDesk Client blindly merges strategy payloads received from the server without authenticating or validating their origin, enabling a network-positioned attacker to inject malicious configuration values. The vulnerability resides in two key source files — src/hbbs_http/sync.rs (the strategy merge loop in the heartbeat sync routine) and hbb_common/src/config.rs (the Config::set_options() function). An attacker performing a MitM attack can intercept HTTP API traffic between the client and the RustDesk relay/API server, then inject crafted strategy payloads or configuration options. Additional attack chains documented in the PoC include re-homing via rustdesk://config/ URI handlers, password overwrite via rustdesk://password/<PWD>, and certificate validation bypass through the danger_accept_invalid_certs fallback (Feedly, PoC Document).

Successful exploitation allows an unauthenticated attacker to silently modify the RustDesk client's configuration and operational strategy, including redirecting the client to a rogue server, overwriting access passwords, and disabling certificate validation — effectively enabling full session hijacking and persistent unauthorized remote access. The confidentiality and integrity impacts are rated High under CVSS v3.1, as sensitive session data and client behavior can be compromised. Because RustDesk is a remote desktop tool, a compromised client could expose the underlying host to full remote control by the attacker, with potential for lateral movement across enterprise environments (Feedly, ENISA EUVD).

A proof-of-concept (PoC) exploit with detailed reproduction steps is publicly available, covering multiple attack chains including strategy injection via a rogue API server, password overwrite, and certificate bypass (PoC Document). As of the latest Feedly update (June 2026), there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.04% (very low automated exploitation probability), and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to be network-positioned to intercept traffic (CVSS v3.1 Attack Complexity: High), though CVSS v4.0 rates the attack complexity as Low given the presence of the required network position (Feedly).

1. Reconnaissance: Identify RustDesk Client deployments (version ≤ 1.4.5) on the target network using network scanning or by observing RustDesk-specific traffic patterns on ports used by the relay server.
2. Network Positioning: Establish a MitM position between the RustDesk client and its configured relay/API server using ARP spoofing, DNS poisoning, rogue Wi-Fi access point, or BGP hijacking on the relevant network segment.
3. Intercept Strategy Sync Traffic: Capture HTTP API traffic from the client's heartbeat sync loop in sync.rs, which periodically polls the server for strategy updates without cryptographic authentication of the response.
4. Inject Malicious Strategy Payload: Craft and inject a forged API response containing a malicious strategy payload (e.g., redirecting relay-server to an attacker-controlled host, setting danger_accept_invalid_certs=true, or modifying access control options) into the intercepted HTTP stream.
5. Trigger Configuration Merge: The client's Config::set_options() function blindly merges the injected options, applying the attacker's configuration without user notification or validation.
6. Re-home Client to Rogue Server: Using the rustdesk://config/ URI handler or injected relay configuration, redirect the client to an attacker-controlled RustDesk server to intercept all subsequent remote desktop sessions.
7. Overwrite Access Password (Optional): Use the rustdesk://password/<PWD> URI or injected config to set a known password, enabling direct unauthorized remote access to the victim's machine (PoC Document).

• Network: Unexpected outbound connections from RustDesk client processes to unfamiliar relay or API server IP addresses/hostnames; HTTP API responses for strategy sync originating from IPs not matching the configured RustDesk server.
• Network: RustDesk traffic observed over unencrypted HTTP where TLS is expected, or TLS connections with invalid/self-signed certificates being accepted silently (indicating danger_accept_invalid_certs activation).
• Logs: RustDesk client logs showing configuration changes to relay-server, api-server, or options fields without corresponding user-initiated actions; log entries reflecting strategy merges from unexpected sources.
• File System: Unexpected modifications to RustDesk configuration files (e.g., RustDesk.toml or platform-equivalent) — particularly changes to relay server addresses, passwords, or certificate validation settings.
• Process: RustDesk client process initiating connections to new relay endpoints shortly after a strategy sync heartbeat cycle; URI handler invocations of rustdesk://config/ or rustdesk://password/ not initiated by the local user (PoC Document).

Users should update RustDesk Client to a version newer than 1.4.5, which addresses the unauthenticated strategy merge vulnerability. As interim workarounds, organizations should implement network security controls to prevent MitM attacks, including enforcing VPN usage for RustDesk traffic, network segmentation, and monitoring for unexpected relay server connections. Administrators should also regularly audit RustDesk configuration files for unauthorized modifications to relay server addresses, passwords, or certificate validation settings (RustDesk Docs, ENISA EUVD).

The vulnerability was covered by the security blog Infinitsec, which highlighted that the RustDesk client "blindly merges unauthenticated strategy payloads, bypassing local configuration protections" (Infinitsec). The CVE was noted on Bluesky by automated CVE tracking accounts and indexed by ENISA's EUVD and INCIBE-CERT, indicating moderate community awareness. No major vendor statements or high-profile researcher commentary beyond the PoC author have been identified at this time.