Executive brief
RustDesk is a remote desktop application used to access and control computers over a network. A critical vulnerability allows attackers to bypass security settings and gain unauthorized control over a device. This could lead to complete system takeover, theft of sensitive data, or disruption of business operations across Windows, macOS, Linux, and mobile platforms.
Technical details
A vulnerability in the RustDesk Client (specifically within the API sync loop and strategy management modules) allows for unauthenticated remote strategy injection. The root cause is located in 'src/hbbs_http/sync.rs' and 'hbb_common/src/config.rs', where the client blindly merges strategy configurations from a server without verifying the local 'allow-remote-config-modification' toggle. An attacker operating a rogue API server or performing a Man-in-the-Middle (MiTM) attack can override local security policies, clear IP whitelists, escalate access modes from view-only to full-control, and re-enable disabled features like file transfer or terminal access. This issue affects all native Flutter-based clients through version 1.4.8.
Affected products
- RustDesk RustDesk Client through 1.4.8
Timeline
- 2026-03-05: disclosed: Initial vulnerability discovery and publication
- 2026-06-22: advisory: Updated advisory confirming impact through version 1.4.8