Executive brief
BetterDesk is a remote desktop management platform used to securely connect and manage client devices. Versions 2.3.0 and earlier fail to properly invalidate deleted device identities, allowing an attacker who knows a deleted device ID to replay or spoof that ID and re-register without proper authentication, potentially bypassing enrollment controls and gaining unauthorized remote access even when no user is logged in.
Technical details
This vulnerability exists in the device registration and deletion logic (CWE-294: Authentication Bypass by Capture-replay, CWE-345: Insufficient Verification of Data Authenticity, CWE-672: Operation on a Resource after Expiration or Release). When a device is deleted, the system marks it as "soft-deleted" but the deletion is not enforced during re-registration; a subsequent registration request with the same device ID causes the system to silently restore the deleted peer record. Combined with GetPeer filtering that hides soft-deleted rows, an unauthenticated attacker can re-register a known deleted device ID, overwrite the Ed25519 public key (bypassing trust-on-first-use), and impersonate the original device. The attack requires network access to the registration endpoint but no authentication credentials. Version 3.0.0-alpha and later patch this by rejecting soft-deleted peers in the registration handler, making deletion final, and adding an explicit restore endpoint requiring admin privileges.
Affected products
- UNITRONIX BetterDesk through 2.3.0
Timeline
- 2026-08-18: disclosed
- 2026-05-28: patched: patch committed; version 3.0.0-alpha contains fix