CVE-2021-47851

CVE-2021-47851 is a remote code execution vulnerability in Mini Mouse version 9.2.0, an iOS remote control application. The flaw stems from an unauthenticated HTTP endpoint at /op=command, which allows attackers to execute arbitrary commands by sending crafted JSON requests containing malicious script commands. Classified under CWE-78 (OS Command Injection), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.

Remote attackers can exploit this vulnerability without authentication by targeting the affected endpoint over the network. Successful exploitation enables full arbitrary command execution on the victim's device, including the ability to download and run payloads, potentially leading to complete system compromise with high confidentiality, integrity, and availability impacts.

Advisories and references, including those from VulnCheck and an Exploit-DB entry (49743), detail the issue and provide exploit code, while the Apple App Store page describes the application. Practitioners should consult these sources for specific mitigation guidance, such as updating to a patched version if available.

An exploit is publicly available on Exploit-DB, indicating potential for real-world abuse against unpatched Mini Mouse 9.2.0 installations.