RustDesk Server Pro generates configuration strings that are intended to be confidential but are produced using a reversible encoding scheme (Base64 followed by a reverse operation) instead of authenticated encryption. This flaw is a classic example of the use of a broken or risky cryptographic algorithm (CWE-327) combined with improper handling of sensitive data (CWE-684). The consequence is that anyone who can access the exported configuration will be able to recover content such as usernames, passwords, or other secrets, leading to confidentiality loss and potentially resulting in credential compromise or session hijacking. The vulnerability is not a code‑execution flaw, but the leakage of secrets can empower further attacks.

The issue covers RustDesk Server Pro on Windows, macOS, and Linux platforms, affecting all releases up through version 1.7.5. The configuration export and web console modules on these operating systems are the affected components.

The CVSS score of 8.7 indicates a high severity. The EPSS score is listed as less than 1 %, suggesting a very low but nonzero probability of exploitation at the time of assessment, and the vulnerability has not been recorded in the CISA KEV catalog. The likely attack vector inferred from the description is that an attacker with access to the server’s web console or the export API could simply trigger a configuration export and then decode the reversible string to obtain sensitive information. Successful exploitation requires authentication to the server but does not require elevated privileges beyond those needed to invoke the export functionality.