Executive brief
RustDesk Client, a remote desktop application, contains a security flaw in how it handles encrypted connections. If a secure connection fails, the software automatically retries using an insecure mode that ignores certificate errors. This allows an attacker positioned on the network to intercept sensitive data, harvest credentials, or inject malicious configuration settings without the user's knowledge.
Technical details
An Improper Certificate Validation vulnerability exists in the RustDesk Client (up to version 1.4.8) within the HTTP API client and TLS transport modules. The root cause is located in `src/hbbs_http/http_client.rs`, where the application is configured to automatically retry failed TLS handshakes using the `danger_accept_invalid_certs(true)` routine. This fallback mechanism allows a network-positioned attacker to perform an Adversary-in-the-Middle (AiTM) attack. Successful exploitation enables the interception of plaintext credentials (such as address book secrets) and the injection of rogue strategy payloads to override local security policies.
Affected products
- RustDesk RustDesk Client through 1.4.8
Timeline
- 2026-03-05: disclosed: Initial vulnerability discovery and TLP:GREEN report published by VULSec Labs.
- 2026-03-05: advisory
- 2026-06-22: other: Advisory updated to confirm the vulnerability persists in version 1.4.8.