PT-2025-1362 · Emote Interactive · Remote Mouse Server

H00Die · Publicado 2025-01-28 · Atualizado 2025-01-28 · CVE-2022-3365

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Remote Mouse Server by Emote Interactive version 4.110

Description The issue arises due to the product's reliance on a trivial substitution cipher sent in cleartext and its use of a default password when no password is set by the user. This allows attackers to inject OS commands over the product's custom control protocol.

Recommendations Remote Mouse Server by Emote Interactive version 4.110: Update the software to a version that does not rely on trivial substitution ciphers and default passwords, or set a strong custom password to mitigate the risk. As a temporary workaround, consider restricting access to the custom control protocol until a patch is available.

Exploit

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2022-3365

Produtos afetados

Remote Mouse Server

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/pull/17067 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/remote_mouse_rce.rb · Exploit
• https://twitter.com/CVEnew/status/1884183334856871948 · Publicação no Twitter
• https://t.me/cvedetector/16564 · Publicação no Telegram
• https://t.me/cvenotify/108801 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-3365 · Nota de Segurança