CVE-2022-3365 - Emote Interactive Remote Mouse Server command injection due to weak encoding · CoreCVE

Back Back to CVE browser

CRITICAL

Emote Interactive Remote Mouse Server command injection due to weak encoding

Published Jan 28, 2025

9.8

CRITICAL

CVSS 3.1

EPSS 2.08%

Description

Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.

Affected products

Vendor Emote Interactive Product Remote Mouse Server Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=4.110

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Emote Interactive

Remote Mouse Server

unaffected

Version	Status	Constraints
0	affected	<=4.110

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-327

Broken Crypto Algorithm

References (1)

https://github.com/rapid7/metasploit-framework/pull/17067
exploit

Link	Providers	Tags
https://github.com/rapid7/metasploit-framework/pull/17067		exploit

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner rapid7

Published Jan 28, 2025

Updated Jan 28, 2025

Reserved Sep 29, 2022

Link CVE-2022-3365

CISA Vulnrichment

Updated Jan 28, 2025

Status Deferred

Modified Jun 17, 2026

Link CVE-2022-3365

Severity n/a

Public date n/a

Links CVE-2022-3365