CVE-2024-25140 Misconfiguration in n/a
RustDesk installs a test certificate in the trusted root store, potentially allowing arbitrary code execution if the private key is compromised.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25140?
CVE-2024-25140 is a critical vulnerability in n/a, published on 6 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation.
Weakness: CWE-295
Which versions are affected by CVE-2024-25140?
It affects 1 product.
Products include Rustdesk Rustdesk.
How do I fix CVE-2024-25140?
No fix has been published for CVE-2024-25140 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-25140 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-25140 exists.
Other vulnerabilities in n/a
- CVE-2026-30793 RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
- CVE-2026-30797 RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server
- CVE-2026-30791 RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
- CVE-2026-30795 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
- CVE-2026-30792 RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings
Sources
Also known as GHSA-xc8c-3cmg-p9qr.