RustDesk Client parses configuration data from URI scheme handlers, CLI options, and web clients. The implementation uses a pseudo‑encryption format without proper cryptographic validation, relying on a weak or broken algorithm. This flaw aligns with CWE‑327 and CWE‑684. An attacker can supply a crafted configuration string that the client decodes without verifying integrity, allowing the attacker to read any sensitive information embedded in the configuration, such as credentials or private keys.

The vulnerability exists in all RustDesk Client binaries for Windows, macOS, Linux, iOS, Android, and the WebClient that include the custom URI scheme and CLI configuration import modules. It affects versions up to and including 14.5 and is present in the files flutter/lib/common.Dart, hbb_common/src/config.Rs, and the routines parseRustdeskUri() and importConfig().

The CVSS base score is 8.7, indicating a high impact, but the EPSS score is less than 1%, suggesting that active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would typically need the ability to supply a malicious configuration string—through direct file editing, an external import, or a crafting of a URI by a trusted party. Once supplied, the client will silently decode and expose any embedded secrets. Treating the input as untrusted and limiting distribution channels mitigates the risk until a secure encryption scheme is used.