The vulnerability resides in RustDesk API versions up to 2.7. An unauthenticated attacker can send a POST request to /api/sysinfo with only a target device ID. The endpoint accepts the request without verifying the caller’s identity or checking the supplied uuid against the stored value, allowing the attacker to overwrite the peer record’s hostname, username, operating system, and uuid. After modifying the record, the attacker can use the new uuid to authenticate and bind the peer to their own account, effectively taking ownership of the device.

Any deployment of RustDesk API from the vendor lejianwen, versions 2.7 and earlier, is affected. The flaw applies to the POST /api/sysinfo route that is used for peer registration and information updates. Systems that have exposed this endpoint to the internet or internal network without additional access controls are susceptible.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of < 1% shows a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation simply requires an unauthenticated HTTP POST to /api/sysinfo; any host with network access to the API can perform the attack. Because authentication is absent and the uuid verification is missing, the bypass is straightforward to execute. If the attacker succeeds, they may bind a peer device to their own account and potentially control the device through subsequent authorized actions.