PT-2021-20913 · Emote Interactive · Emote Interactive Remote Mouse

Leobreaker + 1 · Published 2021-06-24 · Updated 2022-03-29 · CVE-2021-35448

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Emote Interactive Remote Mouse version 3.008

Description: The issue allows attackers to execute arbitrary programs as Administrator. This is achieved by utilizing the Image Transfer Folder feature to navigate to cmd.exe, which enables the execution of commands with elevated privileges. The software binds to local ports to listen for incoming connections, potentially increasing the attack surface.

Recommendations: For Emote Interactive Remote Mouse version 3.008, consider disabling the Image Transfer Folder feature until a patch is available to prevent attackers from navigating to cmd.exe and executing arbitrary programs as Administrator. Restrict access to local ports used by the software to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-35448

Affected Products

Emote Interactive Remote Mouse

References · 5

• 🔥 https://leobreaker1411.github.io/blog/cve-2021-35448 · Exploit
• 🔥 https://deathflash.ml/blog/remote-mouse-lpe · Exploit
• 🔥 https://exploit-db.com/exploits/50047 · Exploit
• https://osv.dev/vulnerability/CVE-2021-35448 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35448 · Security Note