Technical impact
The RustDesk Client transmits the preset address‑book password in plain text within the heartbeat sync JSON payload. This occurs during address‑book and heartbeat sync loops, specifically in src/hbbs_http/sync.rs. The traffic, even when encrypted over HTTPS, carries a reusable shared secret rather than a zero‑knowledge proof. If an attacker can become the API endpoint—such as by hosting a rogue or re‑homed server (CVE‑2026‑30797)—the plaintext password is captured. The leakage authorizes the attacker to access the server‑side address book. The vulnerability allows sniffing attacks in scenarios where the API endpoint is compromised, exposing sensitive contact information.
Affected Systems
The vulnerability exists in RustDesk Client up to version 1.4.8 on all major platforms: Windows, macOS, Linux, iOS, and Android. Any installation of these older client releases is vulnerable because the heartbeat sync implementation does not protect the preset‑address‑book‑password.
Risk and Exploitability
The flaw can be exploited when an attacker controls the API server endpoint that the client connects to. By hosting a rogue or re‑homed API server, the attacker captures the heartbeat sync requests and reads the plaintext preset‑address‑book‑password included in the JSON payload. The credential is a reusable shared secret, so the attacker can use it to access the server‑side address book. The CVSS score of 6.9 indicates medium severity, while the EPSS score of less than 1 % points to a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The primary risk therefore lies in the possibility of an attacker establishing or compromising the API endpoint rather than mere traffic sniffing.
