Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-30793

Summary
Assigner-VULSec
Assigner Org ID-2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Published At-05 Mar, 2026 | 15:21
Updated At-17 Mar, 2026 | 14:30
Rejected At-
Credits

RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation

Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword(). This issue affects RustDesk Client: through 1.4.5.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:VULSec
Assigner Org ID:2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Published At:05 Mar, 2026 | 15:21
Updated At:17 Mar, 2026 | 14:30
Rejected At:
▼CVE Numbering Authority (CNA)
RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation

Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword(). This issue affects RustDesk Client: through 1.4.5.

Affected Products
Vendor
rustdesk-client
Product
RustDesk Client
Collection URL
https://github.com/rustdesk/rustdesk/releases
Package Name
rustdesk-client
Repo
https://github.com/rustdesk/rustdesk,https://github.com/rustdesk/hbb_common
Modules
  • Flutter URI scheme handler
  • FFI bridge
Program Files
  • flutter/lib/common.dart
  • src/flutter_ffi.rs
Program Routines
  • URI handler for rustdesk://password/
  • bind.mainSetPermanentPassword()
Platforms
  • Windows
  • MacOS
  • Linux
  • iOS
  • Android
Default Status
affected
Versions
Affected
  • From 0 through 1.4.5 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-285CWE-285
CWECWE-352CWE-352 Cross-Site Request Forgery (CSRF)
Type: CWE
CWE ID: CWE-285
Description: CWE-285
Type: CWE
CWE ID: CWE-352
Description: CWE-352 Cross-Site Request Forgery (CSRF)
Metrics
VersionBase scoreBase severityVector
4.09.3CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Version: 4.0
Base score: 9.3
Base severity: CRITICAL
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-233CAPEC-233 Privilege Escalation
CAPEC ID: CAPEC-233
Description: CAPEC-233 Privilege Escalation
Solutions

Synchronize privilege logic between CLI and GUI. Require user confirmation. Add config to disable.

Configurations

Default — RustDesk installed with URI scheme handler registered

Workarounds

Unregister the rustdesk:// URI scheme handler at OS level

Exploits

PoC available. Trivially exploitable.

Credits
finder
Erez Kalman
reporter
Erez Kalman
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/rustdesk/rustdesk
product
https://github.com/rustdesk/hbb_common
product
https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub
third-party-advisory
exploit
https://www.vulsec.org/
vdb-entry
third-party-advisory
Hyperlink: https://github.com/rustdesk/rustdesk
Resource:
product
Hyperlink: https://github.com/rustdesk/hbb_common
Resource:
product
Hyperlink: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub
Resource:
third-party-advisory
exploit
Hyperlink: https://www.vulsec.org/
Resource:
vdb-entry
third-party-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Published At:05 Mar, 2026 | 16:16
Updated At:05 Mar, 2026 | 19:38

Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword(). This issue affects RustDesk Client: through 1.4.5.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.09.3CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Secondary
Version: 4.0
Base score: 9.3
Base severity: CRITICAL
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-285Secondary2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
CWE-352Secondary2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
CWE ID: CWE-285
Type: Secondary
Source: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
CWE ID: CWE-352
Type: Secondary
Source: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
N/A
https://github.com/rustdesk/hbb_common2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
N/A
https://github.com/rustdesk/rustdesk2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
N/A
https://www.vulsec.org/2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
N/A
Hyperlink: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub
Source: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Resource: N/A
Hyperlink: https://github.com/rustdesk/hbb_common
Source: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Resource: N/A
Hyperlink: https://github.com/rustdesk/rustdesk
Source: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Resource: N/A
Hyperlink: https://www.vulsec.org/
Source: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

1Records found
CVE-2026-30797
Matching Score-8
Assigner-VULSec Labs
ShareView Details
Matching Score-8
Assigner-VULSec Labs
CVSS Score-9.3||CRITICAL
EPSS-0.46% / 37.02%
||
7 Day CHG~0.00%
Published-05 Mar, 2026 | 15:35
Updated-25 Mar, 2026 | 16:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server

Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files flutter/lib/common.Dart and program routines importConfig() via URI handler. This issue affects RustDesk Client: through 1.4.5.

Action-Not Available
Vendor-rustdeskrustdesk-clientGoogle LLCApple Inc.Microsoft CorporationLinux Kernel Organization, Inc
Product-windowsrustdeskandroidmacosiphone_oslinux_kernelRustDesk Client
CWE ID-CWE-749
Exposed Dangerous Method or Function
CWE ID-CWE-862
Missing Authorization
Details not found