The RustDesk Client accepts insecure TLS certificates after a handshake failure and transmits sensitive information such as address book passwords in clear text, allowing an attacker to extract data via network sniffing. This weakness enables the disclosure of credentials and other private data that the client sends during heartbeat sync operations.

All platforms supported by RustDesk Client—Windows, macOS, Linux, iOS, and Android—are affected for versions up to and including 1.4.5. The issue resides in the heartbeat sync loop modules and the construction of JSON payloads that carry preset‑address‑book‑password data.

With a CVSS score of 8.7 the vulnerability is categorized as high severity, yet the EPSS score is less than 1% indicating a low current exploit probability. The vulnerability is not listed in CISA’s KEV catalog, so no widespread exploitation evidence exists. The likely attack vector is a man‑in‑the‑middle or passive sniffing of traffic, exploiting the client’s silent acceptance of invalid certificates to intercept unencrypted payloads.