GCVE - cpe:2.3:a:rustdesk:rustdesk_server:*:*:*:*:pro:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rustdesk:rustdesk_server:*:*:*:*:pro:*:*:*

part: a version: * update: *

Vendor	Rustdesk (`5c81e261-0c75-5adf-a77f-edf1b41cf4ba`)
Product	Rustdesk Server (`47da5204-82c5-5b8d-bee0-4520d93f349a`)
Edition	*
Language	*
Software edition	pro
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/rustdesk/rustdesk-server`	purl2cpe	2026-06-01 10:17:12.669955

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-3598`	vulnerable	2026-06-08 08:01:19.035935	RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config string generation, web console export modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program routines Config export/generation routines. This issue affects RustDesk Server Pro: through 1.7.5. Published: 2026-03-05T14:14:11.125Z Updated: 2026-03-06T18:18:16.491Z Open on db.gcve.eu Reference links https://rustdesk.com/docs/en/client/ https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub https://www.vulsec.org/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-30796`	vulnerable	2026-06-08 07:57:14.254594	RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book. This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password). This issue affects RustDesk Client: through 1.4.8. Published: 2026-03-05T15:30:39.605Z Updated: 2026-07-19T11:54:37.867Z Open on db.gcve.eu Reference links https://rustdesk.com/docs/en/ https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub https://www.vulsec.org/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-30790`	vulnerable	2026-06-08 07:57:14.216858	Details available Published: 2026-03-05T15:49:15.539Z Updated: 2026-06-22T13:06:15.128Z Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-30784`	vulnerable	2026-06-08 07:57:14.207416	Details available Published: 2026-03-05T15:58:46.790Z Updated: 2026-06-22T07:40:58.235Z Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.