{"id":"CVE-2022-3365","aliases":["EUVD-2022-42745","GHSA-32pm-63j6-22qc"],"status":"published","title":"Emote Interactive Remote Mouse Server command injection due to weak encoding","description":"Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0214,"percentile":0.82192,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-327"],"published":"2025-01-28T00:13:45Z","modified":"2026-06-17T04:59:23Z","exploits":[{"source":"metasploit","id":"exploit/windows/misc/remote_mouse_rce","title":"Remote Mouse RCE","type":"exploit","platform":"Windows","date":"2019-04-15","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/misc/remote_mouse_rce"}],"products":[{"vendor":"emote interactive","product":"remote mouse server"}],"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/17067","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3365"},{"url":"https://github.com/advisories/GHSA-32pm-63j6-22qc"}],"sources":{"cve":[{"id":"CVE-2022-3365","title":"Emote Interactive Remote Mouse Server command injection due to weak encoding","description":"Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.","status":"published","published":"2025-01-28T00:13:45.409Z","modified":"2025-01-28T15:18:05.386Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42745","description":"Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.","status":"published","published":"2025-01-28T00:13:45Z","modified":"2025-01-28T15:18:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:11.814906Z"}],"ghsa":[{"id":"GHSA-32pm-63j6-22qc","title":"Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a...","description":"Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.","status":"published","published":"2025-01-28T03:31:13Z","modified":"2025-01-28T18:31:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:59:42.234766Z"}],"nvd":[{"id":"CVE-2022-3365","description":"Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.","status":"published","published":"2025-01-28T01:15:08.277Z","modified":"2026-06-17T04:59:23.613Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:07:40.977475Z"}]}}