The vulnerability arises because RustDesk Server’s API login employs a double‑SHA256 hash over a server‑controlled salt and challenge, with the authentication proof transmitted in cleartext over HTTP. An attacker who captures the login traffic can recover the hash and perform offline brute‑force attacks with low computational effort. The peer‑to‑peer authentication channel remains secure due to host‑key verification and XSalsa20‑Poly1305 encryption, but the HTTP login path is exposed unless mitigated by TLS downgrade protection. As a result, attackers can gain unauthorized access to user accounts on the server.

Affected deployments are RustDesk Server Pro and the open‑source RustDesk Server (OSS); the CVE data does not specify precise affected versions. The client side vulnerability applies to RustDesk Client through version 1.4.8 on all supported operating systems (Windows, macOS, Linux, iOS, Android).

The CVSS base score of 9.3 signals critical severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The server does not enforce rate limiting and relies on a fast hash, which together increase the feasibility of brute‑force attacks. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers who can obtain the challenge and salt can test password guesses offline with minimal effort, making the risk tangible for any exposed installation.