Vulnerability in Microsoft Windows
CVE-2024-25140
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation.
Vulnerability class: Improper Certificate Validation
EPSS: 0.005 (40.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Windows
- Rustdesk — versions 1.2.3
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Issue Tracking)
- cve@mitre.org (Exploit, Issue Tracking)
- cve@mitre.org (Technical Description, Issue Tracking)
Frequently asked questions
- What is CVE-2024-25140?
- CVE-2024-25140 is a critical-severity vulnerability in Microsoft Windows, classified under Improper Certificate Validation. CVSS score: 9.8/10. Published 2024-02-06.
- How severe is CVE-2024-25140?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2024-25140 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.