A flaw in the RustDesk Client allows an attacker to inject strategy payloads that are merged without authentication during configuration synchronization. Based on the description, the likely attack vector involves a Man‑in‑the‑Middle intercepting unprotected API messages to inject malformed strategy payloads. The violation occurs through an unprotected API message manipulation channel, enabling a Man‑in‑the‑Middle to alter or replace configuration options. This bypasses local security settings and can potentially grant the attacker elevated privileges or persistent control over the client environment.

All versions of the RustDesk Client up to and including 1.4.5 on Windows, macOS, Linux, iOS, Android, and the WebClient are affected. The weakness resides in the client’s configuration engine, specifically the strategy merge loop and the Config::set_options function.

Based on the description, exploitation would typically require a Man‑in‑the‑Middle capable of intercepting and injecting messages between the client and server. The vulnerability carries a CVSS score of 9.1, indicating critical severity. The EPSS score is below 1 %, suggesting a low but non‑zero probability of public exploitation, and the issue is not listed in the CISA KEV catalog. Once an unauthenticated strategy payload is merged, the attacker can change security‑related settings, effectively elevating privileges or establishing a foothold. Because no effective workaround exists, immediate mitigation through an upgrade or proper runtime checks is essential.