CVE-2026-30795: 
NixOS vulnerability analysis and mitigation

CVE-2026-30795 is a Cleartext Transmission of Sensitive Information vulnerability (CWE-319) in the RustDesk Client's heartbeat sync loop module, affecting all platforms (Windows, macOS, Linux, iOS, Android). The vulnerability causes preset address book passwords to be transmitted in cleartext within heartbeat JSON payloads, enabling network sniffing attacks. It affects RustDesk Client through version 1.4.5, with the latest release being 1.4.7 as of June 2026. The CVSS v3.1 base score is 7.5 (High), and the CVSS v4.0 base score is 8.7 (High) (Feedly, ENISA EUVD).

The root cause is classified as CWE-319 (Cleartext Transmission of Sensitive Information), located specifically in src/hbbs_http/sync.rs within the heartbeat JSON payload construction routine for the preset-address-book-password field. During the heartbeat synchronization loop between the RustDesk client and its rendezvous/relay server, sensitive credentials are embedded in JSON payloads and transmitted without encryption, making them interceptable by any network-positioned attacker. No authentication or special privileges are required to exploit this vulnerability — a passive network position (e.g., on the same LAN or via a man-in-the-middle position) is sufficient. A public proof-of-concept document detailing reproduction steps and payload examples is available (PoC Document, Feedly).

Successful exploitation allows an unauthenticated network attacker to intercept and read preset address book passwords transmitted in cleartext during heartbeat synchronization, resulting in a high confidentiality impact with no integrity or availability impact. Captured credentials could be leveraged to gain unauthorized access to remote systems managed via the RustDesk address book, potentially enabling lateral movement across environments where RustDesk is used for remote administration. Organizations using RustDesk in enterprise or managed service provider contexts are at elevated risk due to the breadth of systems potentially accessible through compromised address book credentials (Feedly, ENISA EUVD).

A proof-of-concept exploit document is publicly available, providing detailed reproduction steps and concrete payload examples for this and related RustDesk CVEs (PoC Document). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.027% (0.000270), indicating a currently low probability of exploitation in the near term. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify target environments running RustDesk Client version 1.4.5 or earlier, particularly those using the preset address book feature with configured passwords.
2. Network Positioning: Gain a network-level vantage point capable of intercepting traffic between the RustDesk client and its configured rendezvous/relay server — this could be via ARP spoofing on a LAN, a rogue Wi-Fi access point, or a compromised network device.
3. Traffic Capture: Use a packet capture tool (e.g., Wireshark, tcpdump) to monitor HTTP/HTTPS traffic from the target RustDesk client during its periodic heartbeat synchronization loop.
4. Payload Extraction: Identify heartbeat JSON payloads in the captured traffic originating from src/hbbs_http/sync.rs. Locate the preset-address-book-password field, which is transmitted in cleartext within the JSON body.
5. Credential Harvesting: Extract the plaintext password from the intercepted payload. Note that related RustDesk vulnerabilities use a JSON→Base64→Reversed String encoding scheme for some fields; decode accordingly if obfuscation is present.
6. Credential Abuse: Use the harvested address book password to authenticate to the RustDesk address book or gain unauthorized remote access to systems listed within it (PoC Document, Feedly).

• Network: Unencrypted HTTP traffic containing JSON payloads with a preset-address-book-password field originating from RustDesk client processes; unexpected ARP requests or gratuitous ARP replies on the local network segment suggesting a man-in-the-middle attempt; outbound connections from RustDesk clients to non-standard or unexpected relay/rendezvous server IPs.
• Logs: Network flow logs showing RustDesk heartbeat sync traffic over plaintext HTTP rather than HTTPS; repeated periodic outbound connections from RustDesk client hosts to port 21115 or 21116 (default RustDesk ports) without TLS.
• Process: RustDesk client process (rustdesk.exe on Windows, rustdesk on Linux/macOS) making outbound HTTP connections that can be observed via process network monitoring tools (e.g., netstat, ss, Process Monitor).

Users should update RustDesk Client to a version beyond 1.4.5; the latest release is 1.4.7 (released June 2, 2026) (RustDesk GitHub). As an interim workaround, administrators should implement network-level encryption (e.g., VPN or TLS inspection) to encrypt traffic between RustDesk clients and servers, and avoid configuring sensitive credentials in the preset address book feature until patched. Network segmentation and monitoring for anomalous heartbeat sync traffic can reduce exposure risk (Feedly).

A technical blog post was published at infinitsec.net discussing this and related RustDesk vulnerabilities, including the HTTP client's handling of TLS certificates (Infinitsec Blog). The vulnerability was assigned by VULSec and catalogued by ENISA under EUVD-2026-9829. No significant vendor statement from RustDesk or broad social media discussion has been identified beyond standard vulnerability database aggregation (ENISA EUVD).