GCVE - cpe:2.3:a:rustdesk:rustdesk:*:*:*:*:-:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rustdesk:rustdesk:*:*:*:*:-:*:*:*

part: a version: * update: *

Vendor	Rustdesk (`5c81e261-0c75-5adf-a77f-edf1b41cf4ba`)
Product	Rustdesk (`ae79ea8d-466a-51c3-bb5a-e2982d1a6e7e`)
Edition	*
Language	*
Software edition	-
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:gitee/rustdesk/rustdesk`	purl2cpe	2026-06-01 10:17:12.624608
`pkg:github/rustdesk/rustdesk`	purl2cpe	2026-06-01 10:17:12.624609

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-30798`	vulnerable	2026-06-08 07:57:14.257082	RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines stop-service handler in heartbeat loop. This issue affects RustDesk Client: through 1.4.8. Published: 2026-03-05T15:38:49.156Z Updated: 2026-06-22T13:17:58.024Z Open on db.gcve.eu Reference links https://rustdesk.com/docs/en/client/ https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub https://www.vulsec.org/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-30791`	vulnerable	2026-06-08 07:57:14.218293	RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files flutter/lib/common.Dart, hbb_common/src/config.Rs and program routines parseRustdeskUri(), importConfig(). This issue affects RustDesk Client: through 1.4.5. Published: 2026-03-05T14:47:56.960Z Updated: 2026-03-06T18:16:16.130Z Open on db.gcve.eu Reference links https://rustdesk.com/docs/en/client/ https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub https://www.vulsec.org/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-30785`	vulnerable	2026-06-08 07:57:14.208985	RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS, Linux (Password security module, config encryption, machine UID modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files hbb_common/src/password_security.Rs, hbb_common/src/config.Rs, hbb_common/src/lib.Rs (get_uuid), machine-uid/src/lib.Rs and program routines symmetric_crypt(), encrypt_str_or_original(), decrypt_str_or_original(), get_uuid(), get_machine_id(). This issue affects RustDesk Client: through 1.4.5. Published: 2026-03-05T16:04:36.443Z Updated: 2026-03-06T10:32:38.348Z Open on db.gcve.eu Reference links https://github.com/rustdesk/rustdesk/discussions/9229 https://github.com/rustdesk/rustdesk/discussions/4979 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub https://www.vulsec.org/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.