CVE-2024-25140

    Dashboard / Vulnerabilities / CVE-2024-25140

    CVE-2024-25140

    Published: 6 Feb 2024Last Modified: 28 Oct 2026

    Summary:

    Details: A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation.

    References: https://github.com/rustdesk/rustdesk/discussions/6444, https://news.ycombinator.com/item?id=39256493, https://serverfault.com/questions/837994, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25140.json, https://nvd.nist.gov/vuln/detail/CVE-2024-25140

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cf0e3ec303990a48e0b3a6beedd3587079a6526c
    Fixed -None

    Affected versions

    1.2.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-25140 | CVE-DB