The vulnerability stems from the RustDesk Server’s use of a weak, double‑SHA256 password hash combined with an entropy‑controlled challenge that can be captured and replayed. Authentication attempts are not throttled, allowing an attacker to submit credentials repeatedly. Because the hash function is computationally inexpensive, an attacker can perform offline or online brute‑force attacks to quickly derive valid passwords and gain unauthorized access to the server.

Affected deployments are RustDesk Server Pro up to version 1.7.5 and the open‑source RustDesk Server (OSS) up to 1.1.15. The flaw is present on all supported operating systems—Windows, macOS, and Linux—as it exists in the peer authentication and API login modules.

The CVSS base score of 9.3 signals critical severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The server does not enforce rate limiting and relies on a fast hash, which together increase the feasibility of brute‑force attacks. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers who can obtain the challenge and salt can test password guesses offline with minimal effort, making the risk tangible for any exposed installation.