Cyber Resilience

CVE-2025-66576

HighPublic PoCRCE

Published: 04 December 2025

Published
04 December 2025
Modified
17 December 2025
KEV Added
—
Patch
—
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0089 75.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-66576 is a high-severity OS Command Injection (CWE-78) vulnerability in Remotecontrolio Remote Keyboard Desktop. Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-66576 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in Remote Keyboard Desktop version 1.0.1, classified under CWE-78 (OS Command Injection). The flaw allows remote attackers to execute system commands by abusing the rundll32.exe exported function, resulting in unauthenticated remote code execution. Published on 2025-12-04, it affects this Windows desktop application designed for remote keyboard control.

Remote unauthenticated attackers can exploit the vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables arbitrary command execution on the target system, achieving high-impact compromise of confidentiality, integrity, and availability, potentially leading to full system control.

Advisories, including one from Vulncheck, describe the remote code execution issue in Remote Keyboard Desktop 1.0.1. A proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 52299). The application is hosted on the Microsoft Store and its official website at remotecontrolio.web.app. No patches or specific mitigations are detailed in the provided references.

EU & UK References

Vulnerability details

Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1218.011 Rundll32 Stealth
Adversaries may abuse rundll32.
attack.mitre.org →
Why these techniques?

CVE enables unauthenticated RCE via exploitation of a public-facing remote desktop application (T1190) through OS command injection abusing rundll32.exe (T1218.011).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-4631Shared CWE-78
CVE-2026-42062Shared CWE-78
CVE-2025-41709Shared CWE-78
CVE-2025-56819Shared CWE-78
CVE-2026-34176Shared CWE-78
CVE-2020-37125Shared CWE-78
CVE-2026-34387Shared CWE-78
CVE-2026-32968Shared CWE-78
CVE-2025-60803Shared CWE-78
CVE-2026-25111Shared CWE-78

Affected Assets

remotecontrolio
remote keyboard desktop
1.0.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection in Remote Keyboard Desktop by validating untrusted remote inputs before processing rundll32.exe exported functions.

SI-2 Flaw Remediation good match
preventrecover

Ensures timely identification, reporting, and remediation of the specific command injection flaw (CVE-2025-66576) in version 1.0.1.

AC-6 Least Privilege partial match
prevent

Limits damage from injected commands by enforcing least privilege execution for the Remote Keyboard Desktop application process.

References