This vulnerability in rustdesk-client RustDesk Client affects versions through 1.4.8 and is due to insufficient verification of data authenticity (CWE-345) in modules handling strategy synchronization, HTTP API client, and configuration options. It allows an attacker to manipulate application API messages via man-in-the-middle attacks by exploiting weaknesses in the sync.Rs and config.Rs source files, specifically in the strategy merge loop and Config::set_options() routines. The CVSS 4.0 score is 8.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, but partial confidentiality and availability impact.

An attacker positioned as a man-in-the-middle can manipulate application API messages, potentially leading to unauthorized actions or data corruption within the RustDesk Client. The vulnerability impacts confidentiality and availability partially, which could disrupt normal client operations or expose sensitive data. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the official RustDesk channels for updates and apply any forthcoming patches promptly. Until a fix is available, consider limiting exposure to untrusted networks to reduce the risk of man-in-the-middle attacks.