// For flags

CVE-2024-25140

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation.

Una instalación predeterminada de RustDesk 1.2.3 en Windows coloca un certificado WDKTestCert bajo Autoridades de certificación raíz confiables con uso de clave mejorado de firma de código (1.3.6.1.5.5.7.3.3), válido desde 2023 hasta 2033. Esto es potencialmente no deseado, por ejemplo , porque no existe documentación pública sobre las medidas de seguridad para la clave privada, y se podría firmar software arbitrario si la clave privada se viera comprometida. NOTA: la posición del proveedor es "no tenemos un certificado EV, por lo que utilizamos el certificado de prueba como workaround". La inserción en autoridades de certificación raíz de confianza era el comportamiento previsto originalmente y la interfaz de usuario garantizaba que el paso de instalación del certificado (marcado de forma predeterminada) fuera visible para el usuario antes de continuar con la instalación del producto.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-02-06 CVE Reserved
  • 2024-02-06 CVE Published
  • 2024-02-14 EPSS Updated
  • 2024-08-29 CVE Updated
  • 2024-08-29 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Rustdesk
Search vendor "Rustdesk"
 Rustdesk
Search vendor "Rustdesk" for product "Rustdesk"
 1.2.3
Search vendor "Rustdesk" for product "Rustdesk" and version "1.2.3"
-
Affected
in Microsoft
Search vendor "Microsoft"
 Windows
Search vendor "Microsoft" for product "Windows"
--
Safe