This vulnerability, identified as an improper certificate validation flaw in RustDesk Client’s HTTP API module, allows the client to accept invalid TLS certificates after a handshake failure, enabling an attacker to perform a man‑in‑the‑middle attack and intercept or tamper with encrypted traffic. The weakness is a classic improper certificate validation error (CWE‑295).

Affected binaries include any installation of RustDesk Client through version 1.4.8 on Windows, macOS, Linux, iOS, and Android. The vulnerability resides in the HTTP client module and the TLS retry routine enabling the dangerous_accept_invalid_certs option. The clients listed in known CPEs, such as rustdesk-client:rustdesk_client across all major operating systems, are vulnerable.

The CVSS score of 9.1 marks this as a high‑severity vulnerability. Although the EPSS score is below 1 %, indicating a very low current exploitation probability, the potential impact of a successful Adversary in the Middle remains high. The flaw is not yet included in the CISA KEV catalog, but the absence of a KEV listing does not reduce the risk. Attackers would need to force a TLS handshake failure or redirect connections to their own server, conditions that are achievable with basic network interception tools. Mitigation requires removing the automatic fallback or upgrading to a fixed version.