RustDesk Client vulnerabilities

A vulnerability in the RustDesk client allows for password brute forcing due to insufficient computational effort in hashing and improper restriction of excessive authentication attempts. The authentication mechanism based on SHA256 does not use a slow key-derivation function, enabling attackers to recover passwords offline.

A vulnerability in the RustDesk client transmits the address book password in cleartext within the heartbeat sync JSON body. Although HTTPS encrypts the transmission, the password is a shared secret that can be recovered by an attacker who compromises the API server.

A vulnerability in the RustDesk Client allows Application API Message Manipulation via Man-in-the-Middle. This affects various platforms including Windows, MacOS, Linux, iOS, Android, and WebClient.