CVE-2022-50925

Deeper analysis

Prowise Reflect version 1.0.9 is affected by CVE-2022-50925, a remote keystroke injection vulnerability. The flaw stems from an exposed WebSocket endpoint on port 8082 that allows attackers to send keyboard events. By crafting specific WebSocket messages, adversaries can inject keystrokes remotely, enabling actions such as opening applications and typing arbitrary text. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-346.

Any remote attacker can exploit this vulnerability without authentication or user interaction, as it requires only network access to the WebSocket on port 8082. Exploitation involves creating a malicious web page that connects to the target device and sends crafted messages mimicking keyboard inputs. Successful attacks grant attackers full control over the victim's machine, potentially leading to execution of commands, data exfiltration, or deployment of malware through injected keystrokes.

Advisories from VulnCheck and Exploit-DB document the issue, including a proof-of-concept exploit available at https://www.exploit-db.com/exploits/50796. The vendor site at https://www.prowise.com/ is referenced, though specific patch details are not detailed in available sources. Practitioners should isolate or firewall port 8082 and monitor for anomalous WebSocket traffic until mitigation is confirmed.