VulnerabilityAnalyzed

CVE-2021-47792

Remote Mouse 4.002 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges.

HIGH 8.5EPSS 0.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Remote Mouse 4.002 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path in the RemoteMouseService to inject malicious executables and gain administrative access.

CVSS 4.0: 8.5 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-428
Affected: remotemouse/remote mouse
Source: disclosure@vulncheck.com

References

https://www.exploit-db.com/exploits/50258Exploit
https://www.remotemouse.net/Product
https://www.vulncheck.com/advisories/remote-mouse-unquoted-service-pathThird Party Advisory
https://www.exploit-db.com/exploits/50258Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.