Approved changes feed: RSS · Atom
cpe:2.3:a:rustdesk:rustdesk:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Rustdesk (5c81e261-0c75-5adf-a77f-edf1b41cf4ba) |
|---|---|
| Product | Rustdesk (ae79ea8d-466a-51c3-bb5a-e2982d1a6e7e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gitee/rustdesk/rustdesk |
purl2cpe | 2026-06-01 10:17:12.620223 |
pkg:github/rustdesk/rustdesk |
purl2cpe | 2026-06-01 10:17:12.620225 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-58056 |
vulnerable | 2026-07-29 01:03:16.607675 |
RustDesk - FileTransfer Session Authorization Scope Bypass
HIGH (7.6)
RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.
Published: 2026-06-28T01:32:57.879Z
Updated: 2026-07-18T20:03:21.577Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57850 |
vulnerable | 2026-07-29 01:03:16.352589 |
RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection
HIGH (8.3)
RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope control messages to observe and control the host beyond the permissions it was given.
Published: 2026-07-10T19:53:21.336Z
Updated: 2026-08-11T13:53:25.576Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.