Cyber Posture

CVE-2025-66576

CriticalPublic PoC

Published: 04 December 2025

Published
04 December 2025
Modified
17 December 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0060 69.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection in Remote Keyboard Desktop by validating untrusted remote inputs before processing rundll32.exe exported functions.

SI-2 Flaw Remediation good match
preventrecover

Ensures timely identification, reporting, and remediation of the specific command injection flaw (CVE-2025-66576) in version 1.0.1.

AC-6 Least Privilege partial match
prevent

Limits damage from injected commands by enforcing least privilege execution for the Remote Keyboard Desktop application process.

Security SummaryAI

CVE-2025-66576 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in Remote Keyboard Desktop version 1.0.1, classified under CWE-78 (OS Command Injection). The flaw allows remote attackers to execute system commands by abusing the rundll32.exe exported function, resulting in unauthenticated remote code execution. Published on 2025-12-04, it affects this Windows desktop application designed for remote keyboard control.

Remote unauthenticated attackers can exploit the vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables arbitrary command execution on the target system, achieving high-impact compromise of confidentiality, integrity, and availability, potentially leading to full system control.

Advisories, including one from Vulncheck, describe the remote code execution issue in Remote Keyboard Desktop 1.0.1. A proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 52299). The application is hosted on the Microsoft Store and its official website at remotecontrolio.web.app. No patches or specific mitigations are detailed in the provided references.

Details

CWE(s)
CWE-78

Affected Products

remotecontrolio
remote keyboard desktop
1.0.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1218.011 Rundll32 Stealth
Adversaries may abuse rundll32.
attack.mitre.org →
Why these techniques?

CVE enables unauthenticated RCE via exploitation of a public-facing remote desktop application (T1190) through OS command injection abusing rundll32.exe (T1218.011).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References