PT-2026-20518 · Unknown · Saturn Remote Mouse Server

Indoushka · Publicado 2026-02-18 · Atualizado 2026-02-19 · CVE-2026-27182

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Saturn Remote Mouse Server (affected versions not specified)

Description Saturn Remote Mouse Server has a command injection issue. Unauthenticated attackers can execute arbitrary commands by sending specially crafted UDP JSON frames to port 27000. Attackers on the local network can send malformed packets with unsanitized command data. The service forwards this data directly to OS execution functions, enabling remote code execution under the service account. The vulnerability is triggered by sending specially crafted UDP JSON frames to the ''/api/command'' endpoint. The vulnerable parameter is command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-27182

Produtos afetados

Saturn Remote Mouse Server

Referências · 6

• 🔥 https://packetstorm.news/files/id/215835 · Exploit
• https://saturnremote.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27182 · Nota de Segurança
• https://twitter.com/CVEnew/status/2024233224226902423 · Publicação no Twitter
• https://vulncheck.com/advisories/saturn-remote-mouse-server-udp-command-injection-rce · Nota
• https://t.me/CVEtracker/45019 · Publicação no Telegram