The vulnerability causes the RustDesk Client to transmit the user‑selected address‑book password in cleartext as part of the heartbeat sync JSON payload. Over an intact HTTPS session the password is not exposed in transit, but because it is a reusable shared secret rather than a zero‑knowledge proof the password can be recovered by any party that becomes the API endpoint – for example through TLS downgrade or a rogue server. When the plaintext password reaches the server it authorizes access to the server‑side address book, thereby exposing sensitive contact information. This flaw is a classic example of cleartext transmission of sensitive information (CWE‑319) and insufficiently protected credentials (CWE‑522).

The flaw exists in RustDesk Client versions up through 1.4.8 on Windows, macOS, Linux, iOS, and Android. Any installation of the client in those versions is vulnerable due to the heartbeat sync implementation found in src/hbbs_http/sync.rs.

The likely attack vector is passive sniffing of traffic between the client and the server. Based on the description, it is inferred that an attacker might also tamper with packets to influence the plaintext password sent, though this is not explicitly stated. The vulnerability carries a CVSS score of 6.9, indicating medium severity, but its EPSS score is below 1 %, suggesting a very low probability that exploitation will occur in the wild. The flaw is not listed in CISA's KEV catalog at this time.