RustDesk Server Password Brute Forcing Vulnerability

A vulnerability allowing password brute forcing has been identified in RustDesk Server Pro and RustDesk Server (OSS) versions through 1.7.5 and 1.1.15, respectively. This issue arises from an improper restriction of excessive authentication attempts in the peer authentication and API login modules across Windows, macOS, and Linux. The vulnerability is rooted in the server's password hashing mechanism, which uses SHA256 with insufficient computational effort, allowing for rapid guessing of passwords.

Impact

Exploitation of this vulnerability allows for successful brute force attacks on user passwords, potentially leading to unauthorized access.