CVE-2026-30796 (GCVE-0-2026-30796)

Vulnerability from cvelistv5 – Published: 2026-03-05 15:30 – Updated: 2026-06-22 13:17
VLAI
Title
RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync
Summary
Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the automatic invalid-certificate TLS downgrade (CVE-2026-30794) or a re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book. This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password). This issue affects RustDesk Client: through 1.4.8.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-522 - Insufficiently Protected Credentials
Assigner
References
URL Tags
https://rustdesk.com/docs/en/ technical-descriptionx_--config documentation
https://docs.google.com/document/d/e/2PACX-1vSds6… third-party-advisoryexploit
https://www.vulsec.org/ vdb-entrythird-party-advisory
Impacted products
Vendor Product Version
rustdesk-client RustDesk Client Affected: 0 , ≤ 1.4.8 (custom)
Create a notification for this product.
Date Public
2026-03-05 13:45
Credits
Erez Kalman Erez Kalman
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30796",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-17T14:31:35.721954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-17T14:31:39.098Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/rustdesk/rustdesk/releases",
          "defaultStatus": "affected",
          "modules": [
            "Address book sync",
            "Heartbeat sync loop"
          ],
          "packageName": "rustdesk-client",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "iOS",
            "Android"
          ],
          "product": "RustDesk Client",
          "programFiles": [
            "src/hbbs_http/sync.rs"
          ],
          "programRoutines": [
            {
              "name": "heartbeat sync body builder (emits preset-address-book-password verbatim)"
            }
          ],
          "repo": "https://github.com/rustdesk/rustdesk,https://github.com/rustdesk/hbb_common",
          "vendor": "rustdesk-client",
          "versions": [
            {
              "changes": [
                {
                  "at": "Server Pro",
                  "status": "affected"
                }
              ],
              "lessThanOrEqual": "1.4.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Client with a preset address book password configured"
            }
          ],
          "value": "Client with a preset address book password configured"
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:windows:*:*:*:*:*",
                  "versionEndIncluding": "1.4.8",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:macos:*:*:*:*:*",
                  "versionEndIncluding": "1.4.8",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:linux:*:*:*:*:*",
                  "versionEndIncluding": "1.4.8",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:ios:*:*:*:*:*",
                  "versionEndIncluding": "1.4.8",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:android:*:*:*:*:*",
                  "versionEndIncluding": "1.4.8",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Erez Kalman"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Erez Kalman"
        }
      ],
      "datePublic": "2026-03-05T13:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks.\u003cbr\u003e\u003cbr\u003eThe client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the automatic invalid-certificate TLS downgrade (CVE-2026-30794) or a re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book.\u003cbr\u003e\u003cbr\u003eThis vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password).\u003cbr\u003e\u003cbr\u003eThis issue affects RustDesk Client: through 1.4.8."
            }
          ],
          "value": "Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks.\n\nThe client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the automatic invalid-certificate TLS downgrade (CVE-2026-30794) or a re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book.\n\nThis vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password).\n\nThis issue affects RustDesk Client: through 1.4.8."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PoC available. Trivially exploitable.\u003cbr\u003e"
            }
          ],
          "value": "PoC available. Trivially exploitable."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-157",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-157 Sniffing Attacks"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T13:17:31.551Z",
        "orgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
        "shortName": "VULSec"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "x_--config documentation"
          ],
          "url": "https://rustdesk.com/docs/en/"
        },
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub"
        },
        {
          "tags": [
            "vdb-entry",
            "third-party-advisory"
          ],
          "url": "https://www.vulsec.org/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Transition Address Book API to SRP (Secure Remote Password)"
            }
          ],
          "value": "Transition Address Book API to SRP (Secure Remote Password)"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Avoid setting address book passwords; use account-based access only"
            }
          ],
          "value": "Avoid setting address book passwords; use account-based access only"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
    "assignerShortName": "VULSec",
    "cveId": "CVE-2026-30796",
    "datePublished": "2026-03-05T15:30:39.605Z",
    "dateReserved": "2026-03-05T14:13:37.203Z",
    "dateUpdated": "2026-06-22T13:17:31.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-30796",
      "date": "2026-06-26",
      "epss": "0.00261",
      "percentile": "0.17361"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-30796\",\"sourceIdentifier\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"published\":\"2026-03-05T16:16:21.007\",\"lastModified\":\"2026-03-25T17:50:45.090\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cleartext Transmission of Sensitive Information vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Address book sync API modules) allows Sniffing Attacks. This vulnerability is associated with program files Closed source \u2014 API endpoint handling heartbeat sync and program routines Heartbeat API handler (accepts preset-address-book-password in plaintext).\\n\\nThis issue affects RustDesk Server Pro: through 1.7.5.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de transmisi\u00f3n en texto claro de informaci\u00f3n sensible en rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro en Windows, MacOS, Linux (M\u00f3dulos de API de sincronizaci\u00f3n de libreta de direcciones) permite ataques de sniffing. Esta vulnerabilidad est\u00e1 asociada con archivos de programa de c\u00f3digo cerrado \u2014 punto final de API que gestiona la sincronizaci\u00f3n de latidos y rutinas de programa gestor de API de latidos (acepta preset-address-book-password en texto claro).\\n\\nEste problema afecta a RustDesk Server Pro: hasta la 1.7.5.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-319\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rustdesk:rustdesk_server:*:*:*:*:pro:*:*:*\",\"versionEndIncluding\":\"1.7.5\",\"matchCriteriaId\":\"4F6E21F9-385D-4DB4-9CD4-EDB43561D9E5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"387021A0-AF36-463C-A605-32EA7DAC172E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub\",\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://rustdesk.com/docs/en/\",\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"tags\":[\"Product\",\"Vendor Advisory\"]},{\"url\":\"https://www.vulsec.org/\",\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"tags\":[\"Not Applicable\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-30796\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-17T14:31:35.721954Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-05T16:34:58.670Z\"}}], \"cna\": {\"title\": \"RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Erez Kalman\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Erez Kalman\"}], \"impacts\": [{\"capecId\": \"CAPEC-157\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-157 Sniffing Attacks\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.9, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/rustdesk/rustdesk,https://github.com/rustdesk/hbb_common\", \"vendor\": \"rustdesk-client\", \"modules\": [\"Address book sync\", \"Heartbeat sync loop\"], \"product\": \"RustDesk Client\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"Server Pro\", \"status\": \"affected\"}], \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.4.8\"}], \"platforms\": [\"Windows\", \"MacOS\", \"Linux\", \"iOS\", \"Android\"], \"packageName\": \"rustdesk-client\", \"programFiles\": [\"src/hbbs_http/sync.rs\"], \"collectionURL\": \"https://github.com/rustdesk/rustdesk/releases\", \"defaultStatus\": \"affected\", \"programRoutines\": [{\"name\": \"heartbeat sync body builder (emits preset-address-book-password verbatim)\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"PoC available. Trivially exploitable.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"PoC available. Trivially exploitable.\u003cbr\u003e\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Transition Address Book API to SRP (Secure Remote Password)\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Transition Address Book API to SRP (Secure Remote Password)\", \"base64\": false}]}], \"datePublic\": \"2026-03-05T13:45:00.000Z\", \"references\": [{\"url\": \"https://rustdesk.com/docs/en/\", \"tags\": [\"technical-description\", \"x_--config documentation\"]}, {\"url\": \"https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub\", \"tags\": [\"third-party-advisory\", \"exploit\"]}, {\"url\": \"https://www.vulsec.org/\", \"tags\": [\"vdb-entry\", \"third-party-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Avoid setting address book passwords; use account-based access only\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Avoid setting address book passwords; use account-based access only\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks.\\n\\nThe client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the automatic invalid-certificate TLS downgrade (CVE-2026-30794) or a re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book.\\n\\nThis vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password).\\n\\nThis issue affects RustDesk Client: through 1.4.8.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks.\u003cbr\u003e\u003cbr\u003eThe client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the automatic invalid-certificate TLS downgrade (CVE-2026-30794) or a re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book.\u003cbr\u003e\u003cbr\u003eThis vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password).\u003cbr\u003e\u003cbr\u003eThis issue affects RustDesk Client: through 1.4.8.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-522\", \"description\": \"CWE-522 Insufficiently Protected Credentials\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Client with a preset address book password configured\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Client with a preset address book password configured\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:windows:*:*:*:*:*\", \"vulnerable\": true, \"versionEndIncluding\": \"1.4.8\", \"versionStartIncluding\": \"0\"}, {\"criteria\": \"cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:macos:*:*:*:*:*\", \"vulnerable\": true, \"versionEndIncluding\": \"1.4.8\", \"versionStartIncluding\": \"0\"}, {\"criteria\": \"cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:linux:*:*:*:*:*\", \"vulnerable\": true, \"versionEndIncluding\": \"1.4.8\", \"versionStartIncluding\": \"0\"}, {\"criteria\": \"cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:ios:*:*:*:*:*\", \"vulnerable\": true, \"versionEndIncluding\": \"1.4.8\", \"versionStartIncluding\": \"0\"}, {\"criteria\": \"cpe:2.3:a:rustdesk-client:rustdesk_client:*:*:android:*:*:*:*:*\", \"vulnerable\": true, \"versionEndIncluding\": \"1.4.8\", \"versionStartIncluding\": \"0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\", \"shortName\": \"VULSec\", \"dateUpdated\": \"2026-06-22T13:17:31.551Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-30796\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-22T13:17:31.551Z\", \"dateReserved\": \"2026-03-05T14:13:37.203Z\", \"assignerOrgId\": \"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\", \"datePublished\": \"2026-03-05T15:30:39.605Z\", \"assignerShortName\": \"VULSec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.