CVE-2026-30785

Katalog CVE

CVSS 5.5 · Medium EPSS 0,16%

Kerentanan Storing Passwords in a Recoverable Format pada rustdesk. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS, Linux (Password security module, config encryption, machine UID modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files hbb_common/src/password_security.Rs, hbb_common/src/config.Rs, hbb_common/src/lib.Rs (get_uuid), machine-uid/src/lib.Rs and program routines symmetric_crypt(), encrypt_str_or_original(), decrypt_str_or_original(), get_uuid(), get_machine_id(). This issue affects RustDesk Client: through 1.4.5.

Rincian

Terbit di NVD

5 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-257: Storing Passwords in a Recoverable Format
CWE-323: Reusing a Nonce, Key Pair in Encryption
CWE-916: Use of Password Hash With Insufficient Computational Effort
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUX... exploit · advisory pihak ketiga
• https://github.com/rustdesk/rustdesk/discussions/4979 issue tracking
• https://github.com/rustdesk/rustdesk/discussions/9229 issue tracking
• https://www.vulsec.org/ not applicable