{"id":"CVE-2022-3218","aliases":["EUVD-2022-42632","GHSA-9ccj-j63p-ch9p"],"status":"published","title":"Necta WiFi Mouse (Mouse Server) client-side authentication bypass","description":"Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.74193,"percentile":0.99489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287","CWE-603"],"published":"2022-09-19T16:50:10Z","modified":"2026-06-17T04:59:05Z","exploits":[{"source":"metasploit","id":"exploit/windows/misc/wifi_mouse_rce","title":"Wifi Mouse RCE","type":"exploit","platform":"Windows","date":"2021-02-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/misc/wifi_mouse_rce"},{"source":"pocgithub","id":"MoisesTapia/cve-2022-3218","title":"MoisesTapia/cve-2022-3218","date":"2025-12-18","url":"https://github.com/MoisesTapia/cve-2022-3218"},{"source":"pocgithub","id":"mermehr/MouseServer-1.7.8.5-RCE","title":"mermehr/MouseServer-1.7.8.5-RCE","date":"2026-08-15","url":"https://github.com/mermehr/MouseServer-1.7.8.5-RCE"}],"products":[{"vendor":"necta","product":"wifi_mouse_server"},{"vendor":"necta llc","product":"wifi mouse (mouse server)"}],"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/16985","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/50972","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/49601","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/wifi%20mouse/wifi-mouse-server-rce.py","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/168509/WiFi-Mouse-1.8.3.4-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3218"},{"url":"https://github.com/advisories/GHSA-9ccj-j63p-ch9p"}],"sources":{"cve":[{"id":"CVE-2022-3218","title":"Necta WiFi Mouse (Mouse Server) client-side authentication bypass","description":"Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.","status":"published","published":"2022-09-19T16:50:10.805Z","modified":"2024-09-16T19:05:35.972Z","cwes":["CWE-603"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42632","description":"Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.","status":"published","published":"2022-09-19T16:50:10Z","modified":"2024-09-16T19:05:35Z","updated_at":"2026-11-03T00:55:26.31684Z"}],"ghsa":[{"id":"GHSA-9ccj-j63p-ch9p","title":"Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's...","description":"Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.","status":"published","published":"2022-09-20T00:00:29Z","modified":"2023-02-03T05:06:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:53:50.284505Z"}],"nvd":[{"id":"CVE-2022-3218","description":"Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.","status":"published","published":"2022-09-19T17:15:14.63Z","modified":"2026-06-17T04:59:05.817Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-603","CWE-287"],"updated_at":"2026-11-02T14:07:28.118799Z"}]}}