CVE-2026-30798: 
NixOS vulnerability analysis and mitigation

CVE-2026-30798 is a protocol manipulation vulnerability in the RustDesk Client affecting its heartbeat sync loop and strategy processing modules. It is classified under CWE-345 (Insufficient Verification of Data Authenticity) and CWE-755 (Improper Handling of Exceptional Conditions), allowing unauthenticated remote attackers to crash or stop the RustDesk Client service. All RustDesk Client versions through 1.4.5 are affected across Windows, macOS, Linux, iOS, and Android platforms. The vulnerability was published on March 5, 2026, and assigned by VULSec. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (Feedly, ENISA EUVD).

The vulnerability resides in src/hbbs_http/sync.rs and the stop-service handler within the heartbeat loop of the RustDesk Client. Due to insufficient verification of data authenticity (CWE-345), the client does not properly authenticate or validate incoming protocol messages from the server, allowing a network attacker to deliver rogue strategy payloads. Additionally, improper handling of exceptional conditions (CWE-755) in the heartbeat sync loop means that malformed or malicious messages can trigger unhandled states, causing service termination. The attack vector is network-based, requires no privileges or user interaction, and can be further chained with URI handler abuse (e.g., rustdesk://config/ and rustdesk://password/<PWD>) to re-home clients to attacker-controlled servers (Feedly PoC).

Successful exploitation results in a denial-of-service condition, crashing or stopping the RustDesk Client service and rendering remote access functionality unavailable. There is no direct confidentiality or integrity impact from this specific vulnerability; however, the ability to re-home a client to an attacker-controlled server via protocol manipulation could enable interception of plaintext credentials through the heartbeat sync loop, representing a secondary risk. The cross-platform nature of the vulnerability (Windows, macOS, Linux, iOS, Android) broadens the potential attack surface significantly (Feedly, ENISA EUVD).

A proof-of-concept (PoC) exploit with detailed step-by-step attack sequences is publicly available, including techniques for deep link URI handler abuse, password overwrite, config hijacking, and plaintext credential interception via heartbeat sync (Feedly PoC). The EPSS score is approximately 0.018% (0.000180), indicating low but non-zero probability of exploitation in the wild. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made (Feedly).

1. Reconnaissance: Identify RustDesk Client deployments (versions ≤ 1.4.5) on target networks using network scanning or by identifying exposed RustDesk relay/rendezvous server connections.
2. Client Re-homing via URI Handler: Craft a malicious rustdesk:// deep link URI (e.g., rustdesk://config/<encoded_config>) and deliver it to the target user via phishing or a malicious web page. This abuses the RustDesk URI handler to forcibly redirect the client to an attacker-controlled server.
3. Rogue Server Setup: Operate a rogue RustDesk API/relay server that accepts connections from re-homed clients and is configured to deliver malicious strategy payloads.
4. Heartbeat Sync Exploitation: Once the client connects to the attacker's server, the rogue server delivers crafted strategy payloads through the heartbeat sync loop (src/hbbs_http/sync.rs). Because the client does not verify the authenticity of these messages, it processes them without validation.
5. Service Disruption: Send a malicious stop-service command via the strategy payload, triggering the improper exception handling in the heartbeat loop and causing the RustDesk Client service to crash or terminate.
6. Credential Interception (Optional): While the client is re-homed, intercept plaintext credentials transmitted during the heartbeat sync process, enabling further compromise (Feedly PoC).

• Network: Outbound connections from RustDesk Client to unexpected or unknown relay/rendezvous server IP addresses or domains; unusual HTTP/HTTPS traffic to non-default RustDesk API endpoints from client hosts.
• Logs: RustDesk client logs showing repeated service stop/restart events or heartbeat sync failures; log entries referencing unexpected server addresses in sync.rs-related output.
• Process: Unexpected termination or restart of the RustDesk client process (rustdesk.exe on Windows, rustdesk on Linux/macOS); child processes spawned unexpectedly by the RustDesk service.
• File System / Registry: Modifications to RustDesk configuration files (e.g., RustDesk2.toml) reflecting a changed server address; on Windows, registry changes to RustDesk URI handler registrations (rustdesk://) pointing to unexpected executables.
• URI Handler Abuse: Browser or OS logs showing invocation of rustdesk://config/ or rustdesk://password/ URI schemes from unexpected sources (Feedly PoC).

Upgrade RustDesk Client to a version newer than 1.4.5, which contains the fix for this vulnerability (ENISA EUVD). As a temporary workaround where immediate patching is not possible, implement network-level controls (e.g., firewall rules) to restrict client connections to only trusted RustDesk relay and rendezvous servers, and block external invocation of rustdesk:// URI handlers via browser or OS policy. Monitor for abnormal heartbeat loop behavior, unexpected service restarts, and configuration file changes as indicators of potential exploitation.

A technical blog post was published by Infinit Security detailing how the RustDesk Client accepts unauthenticated stop-service commands via strategy payloads, providing community context on the attack surface (Infinit Security). The vulnerability was also tracked by ENISA's European Vulnerability Database (EUVD-2026-9838) and flagged by INCIBE-CERT in Spain, indicating moderate attention from European cybersecurity authorities (ENISA EUVD, INCIBE-CERT). No significant vendor statement from RustDesk or major social media controversy has been observed at this time.